Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for THREAT-CloudCLI-ScheduledExfil.
Upgrade to ProDetect Scheduled Transfer via Cloud Sync/Backup CLI Tools in Microsoft Sentinel
Adversaries increasingly implement Scheduled Transfer (T1029) not with custom malware beacon loops but by abusing legitimate, already-installed cloud sync and backup command-line tools — rclone, restic, aws-cli (s3 sync/cp), azcopy, and gsutil — invoked on a fixed interval via cron, systemd timers, or Windows Task Scheduler. This approach blends with routine backup/sync traffic, uses signed and expected binaries, and often targets attacker-controlled cloud storage (a non-corporate S3 bucket, a personal rclone remote, a throwaway Backblaze/Azure account) rather than a custom C2 server, evading network-signature and IP-reputation detections. This pattern has been widely observed in ransomware pre-encryption exfiltration (rclone is the single most frequently recovered exfiltration tool across ransomware IR engagements) and in insider-driven bulk data theft where a scheduled job is created to stage and ship data outside normal working hours. This detection complements the existing T1029 coverage (which focuses on raw network beaconing and generic scheduled-task-spawns-transfer-tool patterns) by specifically fingerprinting cloud-storage CLI syntax, non-corporate destination indicators, and the scheduler-persistence mechanism used to make the transfer recurring.
MITRE ATT&CK
- Tactic
- Exfiltration
KQL Detection Query
// THREAT: Scheduled Transfer via Cloud Sync/Backup CLI Tools (T1029)
// Alert 1: Cloud sync/backup CLI tools launched by a scheduler parent process
let CloudCliTools = dynamic(["rclone.exe", "restic.exe", "aws.exe", "azcopy.exe", "gsutil.exe", "gsutil.cmd", "mc.exe"]);
let SchedulerParents = dynamic(["taskeng.exe", "taskhostw.exe", "svchost.exe", "schtasks.exe"]);
let SchedulerLaunches = DeviceProcessEvents
| where Timestamp > ago(14d)
| where FileName in~ (CloudCliTools)
| where InitiatingProcessFileName in~ (SchedulerParents)
| extend UploadVerb = ProcessCommandLine has_any ("sync", "copy", "cp ", "put", "push", "backup", "mb ")
| extend NonCorpDestination = ProcessCommandLine has_any (
"rclone.conf", "personal", "backup-personal"
) or ProcessCommandLine matches regex @"s3://(?!corp-|df00tech-|company-)"
| extend DetectionType = "SchedulerLaunchedCloudCLI"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
InitiatingProcessFileName, InitiatingProcessCommandLine,
UploadVerb, NonCorpDestination, DetectionType;
// Alert 2: Same cloud CLI tool invoked repeatedly (>= 3 times) with upload verbs across a multi-day window — the recurring-schedule signature
let RecurringUploads = DeviceProcessEvents
| where Timestamp > ago(14d)
| where FileName in~ (CloudCliTools)
| where ProcessCommandLine has_any ("sync", "copy", "cp ", "put", "push")
| summarize
RunCount = count(),
FirstRun = min(Timestamp),
LastRun = max(Timestamp),
ActiveDays = dcount(bin(Timestamp, 1d)),
SampleCommandLine = any(ProcessCommandLine)
by DeviceName, AccountName, FileName
| where RunCount >= 3 and ActiveDays >= 2
| extend AvgIntervalHours = round(datetime_diff('hour', LastRun, FirstRun) * 1.0 / (RunCount - 1), 1)
| extend DetectionType = "RecurringCloudCLIUpload"
| project Timestamp = LastRun, DeviceName, AccountName, FileName,
ProcessCommandLine = SampleCommandLine, RunCount, ActiveDays, AvgIntervalHours, DetectionType;
union SchedulerLaunches, RecurringUploads
| sort by Timestamp descDetects T1029 implemented through legitimate cloud CLI tooling on a schedule. Alert 1 flags rclone/restic/aws-cli/azcopy/gsutil/mc launched with a Task Scheduler or service-host parent process, distinguishing an interactively-run backup from one triggered on a timer. Alert 2 flags the same binary invoked 3+ times with upload verbs (sync/copy/cp/put/push) across 2 or more distinct days — the behavioural signature of a recurring scheduled job — independent of whether the launching parent is captured. Both alerts surface the destination command line for manual review since the tools themselves are dual-use.
Data Sources
Required Tables
False Positives & Tuning
- Approved backup software using rclone or restic as its underlying transfer engine, scheduled via Task Scheduler as part of a sanctioned nightly backup job to corporate cloud storage
- IT/DevOps automation that runs aws s3 sync or azcopy on a timer to push build artifacts or logs to an approved corporate bucket/container
- Data engineering pipelines that schedule gsutil or aws-cli transfers between internal systems and an approved analytics data lake
- Managed service provider (MSP) tooling that uses rclone under the hood for multi-tenant customer backup rotation
Other platforms for THREAT-CloudCLI-ScheduledExfil
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Windows — Scheduled Task Running rclone Sync to External Remote
Expected signal: Windows Security Event ID 4698 (scheduled task created) for task name 'CloudBackupSync'. Sysmon Event ID 1 for schtasks.exe process creation with '/create /sc MINUTE /mo 30' in the command line. When the task fires: Sysmon Event ID 1 for taskhostw.exe spawning cmd.exe spawning rclone.exe with 'sync' in the command line.
- Test 2Windows — Recurring aws s3 sync Invocations Simulating a Scheduled Exfiltration Job
Expected signal: Sysmon Event ID 1: three Process Create events for aws.exe with 's3', 'sync', and '--endpoint-url' in the command line, spaced a few seconds apart (compressed for testing; production pattern spans days). Sysmon Event ID 3: connection attempts to 127.0.0.1:9999.
- Test 3Linux — Systemd Timer Triggering Scheduled restic Backup to External Repository
Expected signal: Auditd or Sysmon-for-Linux: file write events for /etc/systemd/system/restic-sync-test.service and .timer. Process execution events for systemctl with 'daemon-reload' and 'enable --now'. When the timer fires: execve event for restic with 'backup' argument, PPID belonging to systemd.
References (7)
- https://attack.mitre.org/techniques/T1029/
- https://rclone.org/docs/
- https://redcanary.com/blog/threat-intelligence/rclone-mass-file-transfer/
- https://www.cisa.gov/news-events/cybersecurity-advisories
- https://learn.microsoft.com/en-us/windows/win32/taskschd/task-scheduler-start-page
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1029/T1029.md
- https://www.freedesktop.org/software/systemd/man/systemd.timer.html
Unlock playbooks & atomic tests with Pro
Get the full detection package for THREAT-CloudCLI-ScheduledExfil — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month
Related Detections
Tactic Hub
Detection Variants (3)
Different telemetry and tradecraft for the same technique — pick the one that matches the data you collect.
- THREAT-ArchiveStaging-ScheduledExfilScheduled Batch Exfiltration of Compressed Archive StagingUse for archive staging — rar/7z multi-volume splitting ahead of a timed transfer, typical of ransomware double-extortion.
- THREAT-Exfil-ScheduledBulkTransferScheduled Off-Hours Bulk Data TransferUse for network-side detection — off-hours bulk-volume NetFlow, when you have no endpoint scheduler visibility.
- THREAT-Exfiltration-LinuxCronScheduledExfilScheduled Data Exfiltration via Linux Cron JobsUse for Linux hosts — cron/systemd-timer job creation correlated with auditd execution and outbound transfer.