Skip to content

Instantly share code, notes, and snippets.

Embed
What would you like to do?
title: Rclone Execution via Command Line or PowerShell
description: Detects Rclone which is commonly used by ransomware groups for exfiltration
status: experimental
date: 2021/05/26
author: Aaron Greetham (@beardofbinary) - NCC Group
references:
- https://research.nccgroup.com/2021/05/27/detecting-rclone-an-effective-tool-for-exfiltration/
tags:
- attack.exfiltration
- attack.t1567.002
falsepositives:
- Legitimate Rclone usage (rare)
level: high
logsource:
product: windows
category: process_creation
detection:
exec_selection:
Image|endswith: '\rclone.exe'
ParentImage|endswith:
- '\PowerShell.exe'
- '\cmd.exe'
command_selection:
CommandLine|contains:
- ' pass '
- ' user '
- ' copy '
- ' mega '
- ' sync '
- ' config '
- ' lsd '
- ' remote '
- ' ls '
condition: exec_selection and 1 of command_selection
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment