Large Volume Data Write to External USB Device

Shadows VMB@Vemorian_Mort

•updated Sep 1, 2026•3•0•7

This rule detects potential data exfiltration by monitoring write activity to external USB storage devices. It identifies scenarios where a high number of files (more than 25) or a significant total volume of data (more than 100MB) is written to a connected USB device within a short timeframe.