High-volume recursive file/directory discovery spanning multiple shares

Duo Tech@duotech

•updated Aug 11, 2026•1•0•5

Detects unusually high-volume recursive file/directory enumeration (dir /s, tree, Get-ChildItem -Recurse) spanning multiple distinct user-profile directories or department shares in a short window, excluding known AV/EDR scanning engines and backup-agent processes.