Insider Threat: Sensitive File Staging to Cloud/Removable Media After-Hours

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•1

This rule detects potential large-scale exfiltration or staging of sensitive documents to common cloud storage locations (Dropbox, Google Drive, OneDrive) or removable media. The rule specifically triggers when a high count (more than 20) of files labeled as sensitive are accessed or transferred by a single user within a session, specifically outside of standard business hours (before 7 AM or after 8 PM).