Rclone RCD Unauthenticated Command Execution via Inline Remote Instantiation (CVE-2026-49980)

union DeviceNetworkEvents, DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where (
    (ActionType == "NetworkConnectionInitiated" and RemotePort == 5572)
    or (FileName in~ ("rclone", "rclone.exe") and ProcessCommandLine has_any ("rcd", "rc-serve", "--rc-serve"))
  )
| extend IsRCDProcess = (FileName in~ ("rclone", "rclone.exe") and ProcessCommandLine has_any ("rcd", "--rc-serve"))
| extend IsNetworkHit = (ActionType == "NetworkConnectionInitiated" and RemotePort == 5572)
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, FileName, ProcessCommandLine, RemoteIP, RemotePort, LocalIP, LocalPort, ActionType, IsRCDProcess, IsNetworkHit
| where IsRCDProcess == true or IsNetworkHit == true

index=* (sourcetype=sysmon OR sourcetype=WinEventLog:Microsoft-Windows-Sysmon/Operational OR sourcetype=linux_audit OR sourcetype=osquery)
| eval proc_name=lower(coalesce(process_name, Image, comm))
| eval cmdline=coalesce(CommandLine, cmdline, process)
| where (proc_name IN ("rclone", "rclone.exe") AND (like(cmdline, "%rcd%") OR like(cmdline, "%rc-serve%") OR like(cmdline, "%--%rc-serve%")))
   OR (dest_port=5572 AND (sourcetype=sysmon OR sourcetype=linux_audit))
| eval detection_reason=case(
    proc_name IN ("rclone", "rclone.exe") AND (like(cmdline, "%rcd%") OR like(cmdline, "%--rc-serve%")), "rclone_rcd_started",
    dest_port=5572, "rc_api_port_connection",
    true(), "unknown"
  )
| stats count, earliest(_time) as first_seen, latest(_time) as last_seen, values(cmdline) as cmdlines, values(src_ip) as src_ips by host, proc_name, detection_reason
| where count > 0
| sort -last_seen

sequence by host.name with maxspan=5m
  [process where event.type == "start"
    and process.name : ("rclone", "rclone.exe")
    and (process.args : "rcd" or process.args : "--rc-serve" or process.command_line : "*rc-serve*")]
  [network where event.type == "connection"
    and (destination.port == 5572 or source.port == 5572)]

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
  sourceip,
  destinationip,
  destinationport,
  "processname",
  "processcmdline",
  username,
  hostname
FROM events
WHERE
  LOGSOURCETYPENAME(devicetype) IN ('Linux OS', 'Windows OS', 'Microsoft Windows Security Event Log')
  AND (
    ("processname" ILIKE '%rclone%'
     AND ("processcmdline" ILIKE '%rcd%' OR "processcmdline" ILIKE '%rc-serve%'))
    OR destinationport = 5572
  )
  AND DATEFORMAT(starttime, 'YYYY-MM-dd') >= DATEADD('day', -7, CURRENT_DATE)
ORDER BY starttime DESC
LIMIT 500

_index=* (_sourcecategory=*sysmon* OR _sourcecategory=*linux* OR _sourcecategory=*endpoint*)
| parse field=_raw "*" as raw_event
| where (toLowerCase(%process_name) matches "*rclone*" and (toLowerCase(%cmdline) matches "*rcd*" or toLowerCase(%cmdline) matches "*rc-serve*"))
   or %dest_port = "5572"
| eval detection_type = if(toLowerCase(%process_name) matches "*rclone*", "rclone_rcd_launch", "rc_api_port_access")
| count by _sourcehost, %process_name, %cmdline, %dest_port, detection_type
| sort by _count desc

rule cve_2026_49980_rclone_rcd_unauthenticated_exec {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects rclone rcd launched with --rc-serve and related RC API activity indicative of CVE-2026-49980"
    severity = "CRITICAL"
    yara_version = "YL2.0"
    rule_version = "1.0"
  events:
    (
      $e.metadata.event_type = "PROCESS_LAUNCH"
      and re.regex($e.principal.process.file.full_path, `(?i)rclone(\.exe)?$`)
      and (
        re.regex($e.principal.process.command_line, `(?i)\brcd\b`)
        or re.regex($e.principal.process.command_line, `(?i)--rc-serve`)
      )
    )
    or
    (
      $e.metadata.event_type = "NETWORK_CONNECTION"
      and $e.target.port = 5572
    )
  condition:
    $e
}

#event_simpleName IN ("ProcessRollup2", "NetworkConnectIP4", "NetworkConnectIP6")
| eval is_rclone_rcd = if(
    match(FileName, "(?i)rclone(\.exe)?$") AND (match(CommandLine, "(?i)\brcd\b") OR match(CommandLine, "(?i)--rc-serve")),
    1, 0
  )
| eval is_rc_port = if(RemotePort == 5572, 1, 0)
| where is_rclone_rcd == 1 OR is_rc_port == 1
| stats count, earliest(timestamp) as first_seen, latest(timestamp) as last_seen, values(CommandLine) as cmdlines, values(RemoteIP) as remote_ips by aid, ComputerName, UserName, FileName, is_rclone_rcd, is_rc_port
| sort last_seen desc