Scheduled Transfer — Scheduled Transfer via Cloud Sync/Backup CLI Tools

// THREAT: Scheduled Transfer via Cloud Sync/Backup CLI Tools (T1029)
// Alert 1: Cloud sync/backup CLI tools launched by a scheduler parent process
let CloudCliTools = dynamic(["rclone.exe", "restic.exe", "aws.exe", "azcopy.exe", "gsutil.exe", "gsutil.cmd", "mc.exe"]);
let SchedulerParents = dynamic(["taskeng.exe", "taskhostw.exe", "svchost.exe", "schtasks.exe"]);
let SchedulerLaunches = DeviceProcessEvents
| where Timestamp > ago(14d)
| where FileName in~ (CloudCliTools)
| where InitiatingProcessFileName in~ (SchedulerParents)
| extend UploadVerb = ProcessCommandLine has_any ("sync", "copy", "cp ", "put", "push", "backup", "mb ")
| extend NonCorpDestination = ProcessCommandLine has_any (
    "rclone.conf", "personal", "backup-personal"
  ) or ProcessCommandLine matches regex @"s3://(?!corp-|df00tech-|company-)"
| extend DetectionType = "SchedulerLaunchedCloudCLI"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
         InitiatingProcessFileName, InitiatingProcessCommandLine,
         UploadVerb, NonCorpDestination, DetectionType;
// Alert 2: Same cloud CLI tool invoked repeatedly (>= 3 times) with upload verbs across a multi-day window — the recurring-schedule signature
let RecurringUploads = DeviceProcessEvents
| where Timestamp > ago(14d)
| where FileName in~ (CloudCliTools)
| where ProcessCommandLine has_any ("sync", "copy", "cp ", "put", "push")
| summarize
    RunCount = count(),
    FirstRun = min(Timestamp),
    LastRun = max(Timestamp),
    ActiveDays = dcount(bin(Timestamp, 1d)),
    SampleCommandLine = any(ProcessCommandLine)
  by DeviceName, AccountName, FileName
| where RunCount >= 3 and ActiveDays >= 2
| extend AvgIntervalHours = round(datetime_diff('hour', LastRun, FirstRun) * 1.0 / (RunCount - 1), 1)
| extend DetectionType = "RecurringCloudCLIUpload"
| project Timestamp = LastRun, DeviceName, AccountName, FileName,
         ProcessCommandLine = SampleCommandLine, RunCount, ActiveDays, AvgIntervalHours, DetectionType;
union SchedulerLaunches, RecurringUploads
| sort by Timestamp desc

// Alert 1: Cloud sync/backup CLI tools launched by a scheduler parent process
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
  (Image="*\\rclone.exe" OR Image="*\\restic.exe" OR Image="*\\aws.exe" OR Image="*\\azcopy.exe"
   OR Image="*\\gsutil.exe" OR Image="*\\gsutil.cmd" OR Image="*\\mc.exe")
  (ParentImage="*\\taskeng.exe" OR ParentImage="*\\taskhostw.exe" OR ParentImage="*\\svchost.exe" OR ParentImage="*\\schtasks.exe")
| eval UploadVerb=if(match(CommandLine, "(?i)(sync|copy|\\bcp\\b|\\bput\\b|push|backup|\\bmb\\b)"), "true", "false")
| eval DetectionType="SchedulerLaunchedCloudCLI"
| table _time, host, User, Image, CommandLine, ParentImage, ParentCommandLine, UploadVerb, DetectionType
| append [
  search index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
    (Image="*\\rclone.exe" OR Image="*\\restic.exe" OR Image="*\\aws.exe" OR Image="*\\azcopy.exe"
     OR Image="*\\gsutil.exe" OR Image="*\\mc.exe")
    (CommandLine="*sync*" OR CommandLine="*copy*" OR CommandLine="* cp *" OR CommandLine="*put*" OR CommandLine="*push*")
  | bin _time span=1d as DayBucket
  | stats count as RunCount, dc(DayBucket) as ActiveDays, earliest(_time) as FirstRun, latest(_time) as LastRun, values(CommandLine) as SampleCommandLines by host, User, Image
  | where RunCount >= 3 AND ActiveDays >= 2
  | eval AvgIntervalHours=round((LastRun - FirstRun) / 3600 / (RunCount - 1), 1)
  | eval DetectionType="RecurringCloudCLIUpload"
  | table LastRun, host, User, Image, SampleCommandLines, RunCount, ActiveDays, AvgIntervalHours, DetectionType
]
| sort - _time

// Alert 1: Cloud CLI tool spawned by a scheduler parent process
process where event.type == "start" and
  process.name in~ ("rclone.exe", "restic.exe", "aws.exe", "azcopy.exe", "gsutil.exe", "mc.exe") and
  process.parent.name in~ ("taskeng.exe", "taskhostw.exe", "svchost.exe", "schtasks.exe") and
  process.args : ("*sync*", "*copy*", "*cp*", "*put*", "*push*", "*backup*")

/* Alert 2: run as a separate EQL query — 3+ upload-verb invocations of the same binary within a 7-day window (sequence with runs) */
sequence by host.name, process.name, user.name with maxspan=7d
  [process where event.type == "start" and
   process.name in~ ("rclone.exe", "restic.exe", "aws.exe", "azcopy.exe", "gsutil.exe") and
   process.args : ("*sync*", "*copy*", "*cp*", "*put*", "*push*")
  ] with runs=3

-- Alert 1: Cloud CLI tool launched by a scheduler parent process
SELECT
  sourceip AS HostIP,
  username AS AccountName,
  "Process Name" AS ProcessName,
  "Command Line" AS CommandLine,
  "Parent Process Name" AS ParentProcess,
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS EventTime
FROM events
WHERE LOGSOURCETYPENAME(devicetype) ILIKE '%Sysmon%'
  AND eventid = 1
  AND "Process Name" ILIKE ANY ('%\\rclone.exe', '%\\restic.exe', '%\\aws.exe', '%\\azcopy.exe', '%\\gsutil.exe', '%\\mc.exe')
  AND "Parent Process Name" ILIKE ANY ('%\\taskeng.exe', '%\\taskhostw.exe', '%\\svchost.exe', '%\\schtasks.exe')
  AND "Command Line" ILIKE ANY ('%sync%', '%copy%', '% cp %', '%put%', '%push%', '%backup%')
LAST 14 DAYS

UNION ALL

-- Alert 2: Same binary invoked 3+ times with upload verbs, aggregated per host/user over the window
SELECT
  sourceip AS HostIP,
  username AS AccountName,
  "Process Name" AS ProcessName,
  COUNT(*) AS RunCount,
  DATEFORMAT(MIN(starttime), 'YYYY-MM-dd HH:mm:ss') AS FirstRun,
  DATEFORMAT(MAX(starttime), 'YYYY-MM-dd HH:mm:ss') AS LastRun
FROM events
WHERE LOGSOURCETYPENAME(devicetype) ILIKE '%Sysmon%'
  AND eventid = 1
  AND "Process Name" ILIKE ANY ('%\\rclone.exe', '%\\restic.exe', '%\\aws.exe', '%\\azcopy.exe', '%\\gsutil.exe')
  AND "Command Line" ILIKE ANY ('%sync%', '%copy%', '% cp %', '%put%', '%push%')
GROUP BY sourceip, username, "Process Name"
HAVING COUNT(*) >= 3
LAST 14 DAYS
ORDER BY EventTime DESC

// Alert 1: Cloud CLI tool launched by a scheduler parent process
(_sourceCategory=windows/sysmon OR _sourceCategory=*sysmon* OR _sourceCategory=endpoint*)
| where EventCode = "1"
| where matches(Image, /(?i)(rclone|restic|aws|azcopy|gsutil|mc)\.exe$/)
| where matches(ParentImage, /(?i)(taskeng|taskhostw|svchost|schtasks)\.exe$/)
| where matches(CommandLine, /(?i)(sync|copy|\bcp\b|\bput\b|push|backup)/)
| "SchedulerLaunchedCloudCLI" as DetectionType
| fields _messageTime, _sourceHost, User, Image, CommandLine, ParentImage, DetectionType

// Alert 2: run as a separate scheduled search — same binary 3+ times with upload verbs over 14 days, grouped by host/user
(_sourceCategory=windows/sysmon OR _sourceCategory=*sysmon* OR _sourceCategory=endpoint*)
| where EventCode = "1"
| where matches(Image, /(?i)(rclone|restic|aws|azcopy|gsutil)\.exe$/)
| where matches(CommandLine, /(?i)(sync|copy|\bcp\b|\bput\b|push)/)
| count as RunCount, min(_messageTime) as FirstRunMs, max(_messageTime) as LastRunMs by _sourceHost, User, Image
| where RunCount >= 3
| "RecurringCloudCLIUpload" as DetectionType
| fields _sourceHost, User, Image, RunCount, FirstRunMs, LastRunMs, DetectionType

rule scheduled_transfer_cloud_cli_from_scheduler {
  meta:
    author = "df00tech detection engineering"
    description = "Detects cloud sync/backup CLI tools (rclone, restic, aws-cli, azcopy, gsutil, mc) launched by a Task Scheduler or service-host parent process with an upload-style command-line verb, consistent with T1029 Scheduled Transfer"
    mitre_technique = "T1029"
    severity = "HIGH"

  events:
    $proc.metadata.event_type = "PROCESS_LAUNCH"
    $proc.target.process.file.full_path = /(?i)(rclone|restic|aws|azcopy|gsutil|mc)\.exe$/
    $proc.principal.process.file.full_path = /(?i)(taskeng|taskhostw|svchost|schtasks)\.exe$/
    $proc.target.process.command_line = /(?i)(sync|copy|\bcp\b|\bput\b|push|backup)/

  outcome:
    $risk_score = 75
    $mitre_technique_id = "T1029"

  condition:
    $proc
}

rule scheduled_transfer_cloud_cli_recurring {
  meta:
    author = "df00tech detection engineering"
    description = "Detects the same cloud CLI transfer binary invoked repeatedly with upload verbs across multiple days for the same host and user, consistent with a recurring scheduled exfiltration job"
    mitre_technique = "T1029"
    severity = "HIGH"

  events:
    $proc.metadata.event_type = "PROCESS_LAUNCH"
    $proc.target.process.file.full_path = /(?i)(rclone|restic|aws|azcopy|gsutil)\.exe$/
    $proc.target.process.command_line = /(?i)(sync|copy|\bcp\b|\bput\b|push)/
    $proc.principal.hostname = $host
    $proc.principal.user.userid = $user

  match:
    $host, $user over 7d

  outcome:
    $run_count = count($proc.metadata.id)
    $risk_score = 70

  condition:
    $proc and $run_count >= 3
}

// Alert 1: Cloud CLI tool launched by a scheduler parent process
#event_simpleName=ProcessRollup2
| in(field="FileName", values=["rclone.exe", "restic.exe", "aws.exe", "azcopy.exe", "gsutil.exe", "mc.exe"], ignoreCase=true)
| in(field="ParentBaseFileName", values=["taskeng.exe", "taskhostw.exe", "svchost.exe", "schtasks.exe"], ignoreCase=true)
| CommandLine=/(?i)(sync|copy|\bcp\b|\bput\b|push|backup)/
| table([ComputerName, UserName, FileName, CommandLine, ParentBaseFileName, ParentCommandLine, timestamp])
| sort(timestamp, order=desc)

// Alert 2: run as a separate scheduled search — same tool invoked 3+ times with upload verbs, grouped by host/user over 7 days
#event_simpleName=ProcessRollup2
| in(field="FileName", values=["rclone.exe", "restic.exe", "aws.exe", "azcopy.exe", "gsutil.exe"], ignoreCase=true)
| CommandLine=/(?i)(sync|copy|\bcp\b|\bput\b|push)/
| stats count(as=RunCount), earliest(timestamp, as=FirstRun), latest(timestamp, as=LastRun) by ComputerName, UserName, FileName
| RunCount>=3