Detect Scheduled Transfer via Cloud Sync/Backup CLI Tools in Google Chronicle

rule scheduled_transfer_cloud_cli_from_scheduler {
  meta:
    author = "df00tech detection engineering"
    description = "Detects cloud sync/backup CLI tools (rclone, restic, aws-cli, azcopy, gsutil, mc) launched by a Task Scheduler or service-host parent process with an upload-style command-line verb, consistent with T1029 Scheduled Transfer"
    mitre_technique = "T1029"
    severity = "HIGH"

  events:
    $proc.metadata.event_type = "PROCESS_LAUNCH"
    $proc.target.process.file.full_path = /(?i)(rclone|restic|aws|azcopy|gsutil|mc)\.exe$/
    $proc.principal.process.file.full_path = /(?i)(taskeng|taskhostw|svchost|schtasks)\.exe$/
    $proc.target.process.command_line = /(?i)(sync|copy|\bcp\b|\bput\b|push|backup)/

  outcome:
    $risk_score = 75
    $mitre_technique_id = "T1029"

  condition:
    $proc
}

rule scheduled_transfer_cloud_cli_recurring {
  meta:
    author = "df00tech detection engineering"
    description = "Detects the same cloud CLI transfer binary invoked repeatedly with upload verbs across multiple days for the same host and user, consistent with a recurring scheduled exfiltration job"
    mitre_technique = "T1029"
    severity = "HIGH"

  events:
    $proc.metadata.event_type = "PROCESS_LAUNCH"
    $proc.target.process.file.full_path = /(?i)(rclone|restic|aws|azcopy|gsutil)\.exe$/
    $proc.target.process.command_line = /(?i)(sync|copy|\bcp\b|\bput\b|push)/
    $proc.principal.hostname = $host
    $proc.principal.user.userid = $user

  match:
    $host, $user over 7d

  outcome:
    $run_count = count($proc.metadata.id)
    $risk_score = 70

  condition:
    $proc and $run_count >= 3
}