Detects potential data destruction and disruption in AMQP deployments by spotting bursts of queue.purge operations across multiple queues from a single client to a broker within a short window. The rule fires when purge responses are observed for at least three distinct queues from one client-to-broker pair, indicating bulk message removal and possible credential misuse after broker access. Implementation uses Elastic Network Packet Capture with an AMQP protocol analyzer; ensures data populated for the method, no-wait, and status fields, and aggregates by client IP and server IP to compute purge_count and queue_count. Trigger conditions require purge_count >= 3 and queue_count >= 3. The approach reduces noise from isolated admin actions and focuses on potentially destructive activity. It links to RabbitMQ audit logs to map identities and recommends cross-correlation with related events (e.g., queue.delete, exchange.delete, bindings, unusual consumers, authentication anomalies) and endpoint alerts. False positives include routine maintenance or testing purges; exceptions should be scoped to approved client-to-broker pairs and queues. Remediation steps include revoking unauthorized credentials, preserving evidence, restoring messages from backups or dead-letter infrastructure, tightening permissions, and investigating credential theft. The rule is aligned with MITRE ATT&CK techniques for Data Destruction (T1485) under the Impact tactic, and contributes to threat detection and incident response guidance.