This is going to be pretty noisy. Uploads happen all the time, many times you will see entire pages re-POSTed to some analytics or ad server host. You could use a 'bytes greater than' threshold, but this will need to be pretty large to get to an acceptable noise level, large enough that a lot of normal documents would not trigger it.
That said, you could try something like this. I am still new to Kusto so perhaps someone will have a better way of doing this and chime in.