Which SIEM platforms have a CVE-2026-49980 detection rule?

df00tech provides CVE-2026-49980 (Rclone RCD Unauthenticated Command Execution via Inline Remote Instantiation (CVE-2026-49980)) detection queries for 7 SIEM platforms: Microsoft Sentinel / Defender, Splunk, Elastic Security (EQL), IBM QRadar (AQL), Sumo Logic CSE, Google Chronicle / SecOps, CrowdStrike LogScale (CQL).

What severity and confidence is the CVE-2026-49980 detection?

The CVE-2026-49980 detection is rated critical severity with high confidence.

What are common false positives for CVE-2026-49980?

Common false positives for CVE-2026-49980 include: Legitimate administrators using rclone rcd with authentication properly configured; Automated backup or sync pipelines that use rclone rcd internally with firewall controls; CI/CD pipelines running rclone for cloud storage operations with --rc-serve enabled in controlled environments.

CVE-2026-49980 Microsoft Sentinel · KQL

Detect Rclone RCD Unauthenticated Command Execution via Inline Remote Instantiation (CVE-2026-49980) in Microsoft Sentinel

Q: What data sources are required to detect Rclone RCD Unauthenticated Command Execution via Inline Remote Instantiation (CVE-2026-49980) (CVE-2026-49980)?

Detecting Rclone RCD Unauthenticated Command Execution via Inline Remote Instantiation (CVE-2026-49980) requires the following data sources: Microsoft Defender for Endpoint, Microsoft Sentinel DeviceProcessEvents, Microsoft Sentinel DeviceNetworkEvents.

CVE-2026-49980 is a critical unauthenticated remote code execution vulnerability in Rclone versions 1.46.0 through 1.74.2. When the rclone remote control daemon (rcd) is started with the --rc-serve flag, an attacker can instantiate arbitrary remotes inline via the RC API without authentication, bypassing the fix introduced for CVE-2026-41179. This allows execution of arbitrary commands on the host running rclone rcd. CVSS 9.8. PoC is publicly available.

MITRE ATT&CK

Tactic: Initial Access Execution Lateral Movement

KQL Detection Query

Microsoft Sentinel (KQL)

kusto

union DeviceNetworkEvents, DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where (
    (ActionType == "NetworkConnectionInitiated" and RemotePort == 5572)
    or (FileName in~ ("rclone", "rclone.exe") and ProcessCommandLine has_any ("rcd", "rc-serve", "--rc-serve"))
  )
| extend IsRCDProcess = (FileName in~ ("rclone", "rclone.exe") and ProcessCommandLine has_any ("rcd", "--rc-serve"))
| extend IsNetworkHit = (ActionType == "NetworkConnectionInitiated" and RemotePort == 5572)
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, FileName, ProcessCommandLine, RemoteIP, RemotePort, LocalIP, LocalPort, ActionType, IsRCDProcess, IsNetworkHit
| where IsRCDProcess == true or IsNetworkHit == true

critical severity high confidence

Detects rclone processes started with rcd/--rc-serve flags and inbound network connections to the default RC API port (5572), indicative of CVE-2026-49980 exploitation attempts.

Data Sources

Microsoft Defender for EndpointMicrosoft Sentinel DeviceProcessEventsMicrosoft Sentinel DeviceNetworkEvents

Required Tables

DeviceProcessEventsDeviceNetworkEvents

False Positives & Tuning

Legitimate administrators using rclone rcd with authentication properly configured
Automated backup or sync pipelines that use rclone rcd internally with firewall controls
CI/CD pipelines running rclone for cloud storage operations with --rc-serve enabled in controlled environments

Other platforms for CVE-2026-49980

Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

Test 1Unauthenticated rclone rcd RC API probe
Expected signal: Process creation event for rclone with arguments including rcd and --rc-no-auth; network bind event on port 5572; outbound HTTP POST to 127.0.0.1:5572
Test 2Inline remote instantiation via unauthenticated RC API
Expected signal: HTTP POST to /config/create on port 5572; rclone process spawned with --rc-no-auth; possible rclone.conf modification event
Test 3Remote command execution via rclone RC /core/command endpoint
Expected signal: HTTP POST to /core/command; rclone process with --rc-no-auth flag in process tree; network event on port 5572 from unexpected source

Last updated: 2026-07-02 Research depth: standard

References (2)

Response Playbook

Triage

Identify all hosts running rclone and check if rcd or --rc-serve arguments are present in running processes using endpoint telemetry or ps/tasklist output.
Determine if port 5572 (or custom --rc-addr port) is exposed externally or to untrusted network segments by reviewing firewall rules and netstat/ss output.
Check the rclone version on affected systems: if between 1.46.0 and 1.74.2 inclusive, treat as confirmed vulnerable and escalate immediately.
Review rclone RC API access logs (if logging is enabled) for POST requests to /config/create, /operations/copyfile, or /core/command endpoints from unexpected source IPs.

Containment

Immediately kill any rclone rcd processes exposed without authentication and block port 5572 at the host firewall and network perimeter until patched or reconfigured with --rc-user and --rc-pass flags.
Isolate the affected host from the network if active exploitation is suspected (unusual child processes spawned by rclone, lateral movement indicators, or exfiltration traffic observed).
Rotate all cloud storage credentials (API keys, OAuth tokens) stored in rclone config files on affected systems, as they may have been exfiltrated via the RC API.

Evidence Collection

Collect the full rclone process command line, parent process, environment variables, and open file descriptors from the affected host before containment disrupts state.
Export network connection logs and web server/proxy logs covering the RC API port for forensic review, capturing all source IPs, request paths, and payloads sent to the rclone rcd endpoint.

Escalation Criteria

!Escalate to incident response if child processes were spawned by rclone (e.g., shell, curl, wget), indicating successful command execution via the RC API.
!Escalate immediately if cloud storage credentials stored in rclone config were accessed or if data exfiltration to unknown remotes is detected via rclone transfer logs or network telemetry.

Investigation Guide

Related Techniques

[object Object][object Object][object Object]

Forensic Artifacts

>Rclone config file (~/.config/rclone/rclone.conf or %APPDATA%/rclone/rclone.conf) — check for newly added remotes with unusual names or attacker-controlled endpoints
>HTTP access logs on port 5572 showing POST requests to /config/create, /operations/copyfile, /core/command, or /rc/noop endpoints
>System process creation logs showing rclone spawning unexpected child processes (sh, bash, cmd.exe, powershell.exe)

Tuning Guidance

Reduce false positives by filtering on known authorized rclone rcd hosts and confirming --rc-user/--rc-pass flags are present (authenticated instances). Alert only on processes missing authentication flags or on connections from external/untrusted IP ranges. Consider allowlisting specific service accounts or hostnames used by managed backup pipelines. Tune port 5572 detections by correlating with process context — a network hit without an associated rclone rcd process on the same host may indicate port reuse by another service.

Hunting Queries

Hunt for all rclone rcd invocations across the fleet over the past 30 days to establish baseline and identify unmanaged or unauthorized instances.

Hunting — KQL

kql

DeviceProcessEvents
| where TimeGenerated > ago(30d)
| where FileName in~ ("rclone", "rclone.exe")
| where ProcessCommandLine has_any ("rcd", "--rc-serve", "--rc-addr", "--rc-no-auth")
| summarize count(), make_set(ProcessCommandLine), make_set(DeviceName) by bin(TimeGenerated, 1h), InitiatingProcessAccountName
| order by TimeGenerated desc

Hunting — SPL

spl

index=* sourcetype IN (sysmon, linux_audit, osquery) process_name IN ("rclone", "rclone.exe")
| search cmdline IN ("*rcd*", "*rc-serve*", "*rc-no-auth*", "*rc-addr*")
| timechart span=1h count by host

Atomic Red Team Tests

Test 1 Unauthenticated rclone rcd RC API probe

linux

Start rclone rcd with --rc-serve and no authentication, then verify the RC API is accessible without credentials by calling the /rc/noop endpoint.

Command

bash

rclone rcd --rc-serve --rc-addr=127.0.0.1:5572 --rc-no-auth &
sleep 2
curl -s -X POST http://127.0.0.1:5572/rc/noop
echo "Exit: $?"

Cleanup

bash

pkill -f 'rclone rcd'

Expected Telemetry

Process creation event for rclone with arguments including rcd and --rc-no-auth; network bind event on port 5572; outbound HTTP POST to 127.0.0.1:5572

Expected Detection

Alert fires on rclone rcd process with --rc-no-auth flag and network connection to RC API port

Test 2 Inline remote instantiation via unauthenticated RC API

linux

Simulate CVE-2026-49980 exploitation by creating an inline remote via the /config/create endpoint without authentication, demonstrating the bypass of CVE-2026-41179 fix.

Command

bash

rclone rcd --rc-serve --rc-addr=127.0.0.1:5572 --rc-no-auth &
sleep 2
curl -s -X POST http://127.0.0.1:5572/config/create \
  -H 'Content-Type: application/json' \
  -d '{"name":"test-inline","type":"local","parameters":{}}'
echo "Remote created: $?"

Cleanup

bash

pkill -f 'rclone rcd'; rclone config delete test-inline 2>/dev/null || true

Expected Telemetry

HTTP POST to /config/create on port 5572; rclone process spawned with --rc-no-auth; possible rclone.conf modification event

Expected Detection

Alert fires on rclone rcd rc-serve process; file integrity monitoring may trigger on rclone.conf modification

Test 3 Remote command execution via rclone RC /core/command endpoint

linux

After establishing unauthenticated access, invoke OS commands through the rclone RC API /core/command endpoint to demonstrate full RCE impact of CVE-2026-49980.

Command

bash

rclone rcd --rc-serve --rc-addr=127.0.0.1:5572 --rc-no-auth &
sleep 2
curl -s -X POST http://127.0.0.1:5572/core/command \
  -H 'Content-Type: application/json' \
  -d '{"command":"version","opt":{},"returnType":"STREAM"}'
echo "Command result: $?"

Cleanup

bash

pkill -f 'rclone rcd'

Expected Telemetry

HTTP POST to /core/command; rclone process with --rc-no-auth flag in process tree; network event on port 5572 from unexpected source

Expected Detection

Alert fires on rclone rcd process with rc-serve and no-auth flags; SIEM correlation between process creation and RC API port activity

Related Detections

Tactic Hubs

TA0001Initial Access TA0002Execution TA0008Lateral Movement

Related Techniques

T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter T1048Exfiltration Over Alternative Protocol

Detect Rclone RCD Unauthenticated Command Execution via Inline Remote Instantiation (CVE-2026-49980) in Microsoft Sentinel

MITRE ATT&CK

KQL Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for CVE-2026-49980

Testing Methodology

Response Playbook

Triage

Containment

Evidence Collection

Escalation Criteria

Investigation Guide

Related Techniques

Forensic Artifacts

Tuning Guidance

Hunting Queries

Atomic Red Team Tests

Command

Cleanup

Expected Telemetry

Expected Detection

Command

Cleanup

Expected Telemetry

Expected Detection

Command

Cleanup

Expected Telemetry

Expected Detection

Related Detections

Tactic Hubs

Related Techniques

Same Tactic: Initial Access

Popular Detections

MITRE ATT&CK

KQL Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for CVE-2026-49980

Testing Methodology

Response Playbook

Triage

Containment

Evidence Collection

Escalation Criteria

Investigation Guide

Related Techniques

Forensic Artifacts

Tuning Guidance

Hunting Queries

Atomic Red Team Tests

Command

Cleanup

Expected Telemetry

Expected Detection

Command

Cleanup

Expected Telemetry

Expected Detection

Command

Cleanup

Expected Telemetry

Expected Detection

Related Detections

Tactic Hubs

Related Techniques

Same Tactic: Initial Access

Popular Detections

Get new detections in your inbox