Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for THREAT-CloudCLI-ScheduledExfil.
Upgrade to ProDetect Scheduled Transfer via Cloud Sync/Backup CLI Tools in Sumo Logic CSE
Adversaries increasingly implement Scheduled Transfer (T1029) not with custom malware beacon loops but by abusing legitimate, already-installed cloud sync and backup command-line tools — rclone, restic, aws-cli (s3 sync/cp), azcopy, and gsutil — invoked on a fixed interval via cron, systemd timers, or Windows Task Scheduler. This approach blends with routine backup/sync traffic, uses signed and expected binaries, and often targets attacker-controlled cloud storage (a non-corporate S3 bucket, a personal rclone remote, a throwaway Backblaze/Azure account) rather than a custom C2 server, evading network-signature and IP-reputation detections. This pattern has been widely observed in ransomware pre-encryption exfiltration (rclone is the single most frequently recovered exfiltration tool across ransomware IR engagements) and in insider-driven bulk data theft where a scheduled job is created to stage and ship data outside normal working hours. This detection complements the existing T1029 coverage (which focuses on raw network beaconing and generic scheduled-task-spawns-transfer-tool patterns) by specifically fingerprinting cloud-storage CLI syntax, non-corporate destination indicators, and the scheduler-persistence mechanism used to make the transfer recurring.
MITRE ATT&CK
- Tactic
- Exfiltration
Sumo Detection Query
// Alert 1: Cloud CLI tool launched by a scheduler parent process
(_sourceCategory=windows/sysmon OR _sourceCategory=*sysmon* OR _sourceCategory=endpoint*)
| where EventCode = "1"
| where matches(Image, /(?i)(rclone|restic|aws|azcopy|gsutil|mc)\.exe$/)
| where matches(ParentImage, /(?i)(taskeng|taskhostw|svchost|schtasks)\.exe$/)
| where matches(CommandLine, /(?i)(sync|copy|\bcp\b|\bput\b|push|backup)/)
| "SchedulerLaunchedCloudCLI" as DetectionType
| fields _messageTime, _sourceHost, User, Image, CommandLine, ParentImage, DetectionType
// Alert 2: run as a separate scheduled search — same binary 3+ times with upload verbs over 14 days, grouped by host/user
(_sourceCategory=windows/sysmon OR _sourceCategory=*sysmon* OR _sourceCategory=endpoint*)
| where EventCode = "1"
| where matches(Image, /(?i)(rclone|restic|aws|azcopy|gsutil)\.exe$/)
| where matches(CommandLine, /(?i)(sync|copy|\bcp\b|\bput\b|push)/)
| count as RunCount, min(_messageTime) as FirstRunMs, max(_messageTime) as LastRunMs by _sourceHost, User, Image
| where RunCount >= 3
| "RecurringCloudCLIUpload" as DetectionType
| fields _sourceHost, User, Image, RunCount, FirstRunMs, LastRunMs, DetectionTypeTwo Sumo Logic searches for T1029 via cloud CLI tooling. The first matches Sysmon Event ID 1 where a cloud sync/backup CLI binary is spawned by a Task Scheduler or service-host parent process with an upload-style command-line verb. The second aggregates the same binaries by host/user over a 14-day window and flags 3 or more upload-verb invocations — the recurring-schedule behavioural signature. Run as scheduled searches; combine into a single dashboard panel via a Sumo Logic Scheduled View.
Data Sources
False Positives & Tuning
- Approved backup automation using rclone/restic scheduled via Task Scheduler to a corporate storage destination
- CI/CD pipelines invoking aws s3 sync or azcopy on a recurring schedule to an approved bucket
- MSP-managed backup tooling built on rclone for scheduled multi-tenant backup rotation
Other platforms for THREAT-CloudCLI-ScheduledExfil
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Windows — Scheduled Task Running rclone Sync to External Remote
Expected signal: Windows Security Event ID 4698 (scheduled task created) for task name 'CloudBackupSync'. Sysmon Event ID 1 for schtasks.exe process creation with '/create /sc MINUTE /mo 30' in the command line. When the task fires: Sysmon Event ID 1 for taskhostw.exe spawning cmd.exe spawning rclone.exe with 'sync' in the command line.
- Test 2Windows — Recurring aws s3 sync Invocations Simulating a Scheduled Exfiltration Job
Expected signal: Sysmon Event ID 1: three Process Create events for aws.exe with 's3', 'sync', and '--endpoint-url' in the command line, spaced a few seconds apart (compressed for testing; production pattern spans days). Sysmon Event ID 3: connection attempts to 127.0.0.1:9999.
- Test 3Linux — Systemd Timer Triggering Scheduled restic Backup to External Repository
Expected signal: Auditd or Sysmon-for-Linux: file write events for /etc/systemd/system/restic-sync-test.service and .timer. Process execution events for systemctl with 'daemon-reload' and 'enable --now'. When the timer fires: execve event for restic with 'backup' argument, PPID belonging to systemd.
References (7)
- https://attack.mitre.org/techniques/T1029/
- https://rclone.org/docs/
- https://redcanary.com/blog/threat-intelligence/rclone-mass-file-transfer/
- https://www.cisa.gov/news-events/cybersecurity-advisories
- https://learn.microsoft.com/en-us/windows/win32/taskschd/task-scheduler-start-page
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1029/T1029.md
- https://www.freedesktop.org/software/systemd/man/systemd.timer.html
Unlock playbooks & atomic tests with Pro
Get the full detection package for THREAT-CloudCLI-ScheduledExfil — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month
Related Detections
Tactic Hub
Detection Variants (3)
Different telemetry and tradecraft for the same technique — pick the one that matches the data you collect.
- THREAT-ArchiveStaging-ScheduledExfilScheduled Batch Exfiltration of Compressed Archive StagingUse for archive staging — rar/7z multi-volume splitting ahead of a timed transfer, typical of ransomware double-extortion.
- THREAT-Exfil-ScheduledBulkTransferScheduled Off-Hours Bulk Data TransferUse for network-side detection — off-hours bulk-volume NetFlow, when you have no endpoint scheduler visibility.
- THREAT-Exfiltration-LinuxCronScheduledExfilScheduled Data Exfiltration via Linux Cron JobsUse for Linux hosts — cron/systemd-timer job creation correlated with auditd execution and outbound transfer.