Mass file deletion/modification in sanctioned cloud storage via Netskope CASB
Detects high-volume file deletion or modification activity within sanctioned cloud storage applications, monitored via Netskope. This behavior is indicative of potential ransomware, malicious bulk data destruction, or an insider threat attempting to sabotage data.
Microsoft Sentinel (KQL)
