Detect Scheduled Transfer via Cloud Sync/Backup CLI Tools in Sumo Logic CSE
Adversaries increasingly implement Scheduled Transfer (T1029) not with custom malware beacon loops but by abusing legitimate, already-installed cloud sync and backup command-line tools — rclone, restic, aws-cli (s3 sync/cp), azcopy, and gsutil — invoked on a fixed interval via cron, systemd timers, or Windows Task Scheduler. This approach blends with routine backup/sync traffic, uses signed and expected binaries, and often targets attacker-controlled cloud storage (a non-corporate S3 bucket, a personal rclone remote, a throwaway Backblaze/Azure account) rather than a custom C2 server, evading network-signature and IP-reputation detections. This pattern has been widely observed in ransomware pre-encryption exfiltration (rclone is the single most frequently recovered exfiltration tool across ransomware IR engagements) and in insider-driven bulk data theft where a scheduled job is created to stage and ship data outside normal working hours. This detection complements the existing T1029 coverage (which focuses on raw network beaconing and generic scheduled-task-spawns-transfer-tool patterns) by specifically fingerprinting cloud-storage CLI syntax, non-corporate destination indicators, and the scheduler-persistence mechanism used to make the transfer recurring.
MITRE ATT&CK
- Tactic
- Exfiltration
Sumo Detection Query
// Alert 1: Cloud CLI tool launched by a scheduler parent process
(_sourceCategory=windows/sysmon OR _sourceCategory=*sysmon* OR _sourceCategory=endpoint*)
| where EventCode = "1"
| where matches(Image, /(?i)(rclone|restic|aws|azcopy|gsutil|mc)\.exe$/)
| where matches(ParentImage, /(?i)(taskeng|taskhostw|svchost|schtasks)\.exe$/)
| where matches(CommandLine, /(?i)(sync|copy|\bcp\b|\bput\b|push|backup)/)
| "SchedulerLaunchedCloudCLI" as DetectionType
| fields _messageTime, _sourceHost, User, Image, CommandLine, ParentImage, DetectionType
// Alert 2: run as a separate scheduled search — same binary 3+ times with upload verbs over 14 days, grouped by host/user
(_sourceCategory=windows/sysmon OR _sourceCategory=*sysmon* OR _sourceCategory=endpoint*)
| where EventCode = "1"
| where matches(Image, /(?i)(rclone|restic|aws|azcopy|gsutil)\.exe$/)
| where matches(CommandLine, /(?i)(sync|copy|\bcp\b|\bput\b|push)/)
| count as RunCount, min(_messageTime) as FirstRunMs, max(_messageTime) as LastRunMs by _sourceHost, User, Image
| where RunCount >= 3
| "RecurringCloudCLIUpload" as DetectionType
| fields _sourceHost, User, Image, RunCount, FirstRunMs, LastRunMs, DetectionTypeTwo Sumo Logic searches for T1029 via cloud CLI tooling. The first matches Sysmon Event ID 1 where a cloud sync/backup CLI binary is spawned by a Task Scheduler or service-host parent process with an upload-style command-line verb. The second aggregates the same binaries by host/user over a 14-day window and flags 3 or more upload-verb invocations — the recurring-schedule behavioural signature. Run as scheduled searches; combine into a single dashboard panel via a Sumo Logic Scheduled View.
Data Sources
False Positives & Tuning
- Approved backup automation using rclone/restic scheduled via Task Scheduler to a corporate storage destination
- CI/CD pipelines invoking aws s3 sync or azcopy on a recurring schedule to an approved bucket
- MSP-managed backup tooling built on rclone for scheduled multi-tenant backup rotation
Other platforms for THREAT-CloudCLI-ScheduledExfil
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Windows — Scheduled Task Running rclone Sync to External Remote
Expected signal: Windows Security Event ID 4698 (scheduled task created) for task name 'CloudBackupSync'. Sysmon Event ID 1 for schtasks.exe process creation with '/create /sc MINUTE /mo 30' in the command line. When the task fires: Sysmon Event ID 1 for taskhostw.exe spawning cmd.exe spawning rclone.exe with 'sync' in the command line.
- Test 2Windows — Recurring aws s3 sync Invocations Simulating a Scheduled Exfiltration Job
Expected signal: Sysmon Event ID 1: three Process Create events for aws.exe with 's3', 'sync', and '--endpoint-url' in the command line, spaced a few seconds apart (compressed for testing; production pattern spans days). Sysmon Event ID 3: connection attempts to 127.0.0.1:9999.
- Test 3Linux — Systemd Timer Triggering Scheduled restic Backup to External Repository
Expected signal: Auditd or Sysmon-for-Linux: file write events for /etc/systemd/system/restic-sync-test.service and .timer. Process execution events for systemctl with 'daemon-reload' and 'enable --now'. When the timer fires: execve event for restic with 'backup' argument, PPID belonging to systemd.
References (7)
- https://attack.mitre.org/techniques/T1029/
- https://rclone.org/docs/
- https://redcanary.com/blog/threat-intelligence/rclone-mass-file-transfer/
- https://www.cisa.gov/news-events/cybersecurity-advisories
- https://learn.microsoft.com/en-us/windows/win32/taskschd/task-scheduler-start-page
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1029/T1029.md
- https://www.freedesktop.org/software/systemd/man/systemd.timer.html
Response Playbook
Triage
- Identify the exact cloud CLI tool and command verb used (sync, copy, cp, put, push, mb) — confirm whether this binary and its config file (e.g. rclone.conf, ~/.aws/credentials) are part of an approved backup deployment on this host, and check your CMDB/asset inventory for a documented backup schedule.
- Extract the destination remote/bucket/container name from the command line and resolve it — is it a known corporate storage account, or an unfamiliar bucket, personal cloud account, or a remote defined in a config file that was recently modified?
- Check when the rclone/aws/azcopy config file was created or last modified (file metadata, Sysmon Event ID 11) — a newly created remote/profile immediately preceding the first scheduled run is a strong indicator the schedule was adversary-established rather than pre-existing IT automation.
- Review the scheduling mechanism directly: on Windows run schtasks /query /fo LIST /v /tn "<TaskName>" for the task that launched the CLI tool; on Linux inspect crontab -l for the account and /etc/systemd/system/*.timer plus the paired .service unit's ExecStart line.
- Quantify data volume transferred: cloud CLI tools log per-run transfer stats (rclone logs bytes transferred by default at INFO level; aws s3 sync/cp emit per-object progress) — pull the tool's own log file if configured, or estimate from DeviceNetworkEvents SentBytes for the process over the observed run window.
- Determine whether the account context running the job is a service account, backup account, or a regular/interactive user account — a scheduled cloud-CLI transfer running under a standard user's own login session (not a dedicated backup service account) is unusual and warrants escalation.
Containment
- If the destination is confirmed unauthorised: revoke the credentials/API keys used by the CLI tool immediately (AWS: deactivate/delete the access key via IAM; rclone: remove or rotate the remote's stored token; Azure: revoke the SAS token or service principal used by azcopy).
- Disable and remove the scheduling artifact that triggers the transfer: schtasks /delete /tn "<TaskName>" /f on Windows, or crontab -e / systemctl disable --now <unit>.timer on Linux — export the definition first for evidence.
- Quarantine or remove the tool's configuration file containing the attacker-controlled remote/profile (rclone.conf, aws credentials profile, azcopy job plan) after copying it for forensic preservation.
- If data was confirmed transferred to external cloud storage: engage the destination cloud provider's abuse/trust-and-safety process where possible to request takedown or preservation of the uploaded objects, and document the destination account/bucket ARN or resource ID for legal follow-up.
- Rotate credentials for the account context under which the scheduled job ran, and review that account for other persistence mechanisms (additional scheduled tasks, autostart entries) established around the same time window.
- Isolate the endpoint if this activity correlates with other indicators of compromise (credential dumping, lateral movement) rather than appearing to be a standalone insider-driven scheduling action.
Evidence Collection
- Scheduled Task XML (Windows): C:\Windows\System32\Tasks\<TaskName> — full trigger definition, action command line, and run-as account. Windows Security Event ID 4698/4699/4702 if task auditing is enabled.
- Cron/systemd artifacts (Linux): crontab for the relevant user, /etc/cron.d/*, and for systemd timers both the .timer and .service unit files under /etc/systemd/system/ or the user's ~/.config/systemd/user/.
- Cloud CLI configuration files: rclone.conf (often at ~/.config/rclone/rclone.conf or %APPDATA%\rclone\rclone.conf), ~/.aws/credentials and ~/.aws/config, AzCopy job plan files under ~/.azcopy or %USERPROFILE%\.azcopy — preserve remote/profile definitions verbatim including timestamps.
- Tool-native logs: rclone --log-file output (if configured) records per-transfer byte counts and remote names; AWS CloudTrail records GetObject/PutObject calls if the destination is an AWS account you have visibility into; Azure Storage diagnostic logs record blob PUT operations against a monitored storage account.
- Process creation and command-line history: Sysmon Event ID 1 or DeviceProcessEvents for every invocation of the CLI tool, preserving the full command line including any --include/--exclude filters that indicate targeted data selection.
- Network connection records: Sysmon Event ID 3 or DeviceNetworkEvents for the CLI process, capturing destination IP/hostname and SentBytes to establish actual transferred volume when tool-native logs are unavailable.
- Prefetch entries (Windows) for the CLI binary: C:\Windows\Prefetch\RCLONE.EXE-*.pf, AWS.EXE-*.pf, AZCOPY.EXE-*.pf — confirms execution history and count even if command-line logging was not enabled at the time.
Escalation Criteria
- !The destination remote/bucket/account does not match any entry in the approved backup/storage destination inventory and was configured recently (config file created or modified within days of the first observed transfer).
- !The scheduled job runs under an interactive user account rather than a dedicated backup/service account, particularly if that user does not normally have backup administration responsibilities.
- !Transfer volume is large (multiple GB) or includes file filters/include-patterns targeting sensitive directories (finance, HR, legal, source code repositories) rather than a broad, undifferentiated backup set.
- !The scheduling artifact (scheduled task, cron entry, systemd timer) was created outside of change-management/IT automation processes, or immediately follows other suspicious activity such as credential access or privilege escalation on the same host.
- !Multiple hosts show the same cloud CLI tool, remote configuration, or destination bucket/container being used on a schedule — indicating a coordinated, possibly script-deployed exfiltration mechanism rather than an isolated incident.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
rclone configuration file: ~/.config/rclone/rclone.conf (Linux/macOS) or %APPDATA%\rclone\rclone.conf (Windows) — contains remote names, endpoint URLs, and (if not using external credential storage) access tokens. - >
AWS CLI configuration and credentials: ~/.aws/config and ~/.aws/credentials — profile names, region, and access key IDs used for s3 sync/cp operations. - >
AzCopy job plan and log directory: ~/.azcopy or %USERPROFILE%\.azcopy — per-job plan files recording source, destination SAS URL (redacted in logs but present in job plan), and transfer statistics. - >
Windows Task Scheduler XML and TaskCache registry: C:\Windows\System32\Tasks\ and HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\ — trigger schedule and last/next run time for the task that launches the CLI tool. - >
Linux crontab and systemd timer units: /var/spool/cron/crontabs/<user>, /etc/cron.d/*, /etc/systemd/system/*.timer plus paired *.service ExecStart lines — the recurring trigger definition. - >
Shell history: ~/.bash_history, ~/.zsh_history, PowerShell ConsoleHost_history.txt — may reveal manual testing of the CLI command prior to scheduling it. - >
Cloud-side audit logs (where visibility exists): AWS CloudTrail PutObject/GetObject events, Azure Storage diagnostic logs, or Google Cloud Audit Logs for storage.objects.create — corroborate the destination-side receipt of the transferred data and its actual byte volume.
Tuning Guidance
This detection will generate false positives in any environment with legitimate rclone/restic/aws-cli/azcopy-based backup automation, which is common — these tools are popular precisely because they are simple, well-documented, and free. The single highest-leverage tuning step is building and maintaining an allowlist of approved destination buckets/containers/remotes (used directly in hunting query 2) and excluding scheduled tasks whose task name matches your organisation's IT-managed backup naming convention. Where possible, require that backup/sync automation run under a dedicated, non-interactive service account with a restrictive login-type policy (deny interactive logon) — this lets you cheaply distinguish sanctioned automation (dedicated service account) from adversary-established scheduling (typically runs under a compromised interactive user's own session or SYSTEM via schtasks). For the recurring-invocation alert, raise the RunCount/ActiveDays thresholds in environments with frequent (e.g. hourly) legitimate sync jobs to avoid alert fatigue, and correlate with DeviceFileEvents to confirm sensitive-directory access preceded the transfer rather than alerting on the transfer tool's execution alone. Periodically audit all Task Scheduler tasks and crontab entries across the fleet for any of the named CLI binaries in their action/command field — this is a cheap point-in-time compensating control alongside the near-real-time detection above.
Hunting Queries
Hunt for the specific sequence of a cloud CLI credential/config file being created or modified, followed within 24 hours by a scheduler-launched invocation of the corresponding tool. This is the strongest available signal that an adversary configured a new remote/destination and immediately operationalised it as a recurring scheduled transfer, as opposed to a pre-existing, long-running backup job.
// Hunt: New rclone/aws/azcopy/gsutil configuration file created or modified, followed within 24 hours by a scheduled-task-launched invocation of the same tool
let ConfigWrites = DeviceFileEvents
| where Timestamp > ago(14d)
| where FileName in~ ("rclone.conf", "credentials", "config") or FileName endswith ".azcopy"
| where FolderPath has_any (".config\\rclone", ".aws", ".azcopy", "AppData\\rclone")
| project ConfigTime = Timestamp, DeviceName, ConfigPath = FolderPath, ConfigFile = FileName, ConfigAccount = InitiatingProcessAccountName;
DeviceProcessEvents
| where Timestamp > ago(14d)
| where FileName in~ ("rclone.exe", "aws.exe", "azcopy.exe", "gsutil.exe")
| where InitiatingProcessFileName in~ ("taskeng.exe", "taskhostw.exe", "svchost.exe")
| join kind=inner ConfigWrites on DeviceName
| where Timestamp between (ConfigTime .. (ConfigTime + 24h))
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, ConfigTime, ConfigPath, ConfigFile
| sort by Timestamp descindex=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11
(TargetFilename="*rclone.conf" OR TargetFilename="*\\.aws\\credentials" OR TargetFilename="*.azcopy*")
| eval ConfigTime=_time
| eval ConfigHost=host
| join type=inner host [
search index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
(Image="*\\rclone.exe" OR Image="*\\aws.exe" OR Image="*\\azcopy.exe" OR Image="*\\gsutil.exe")
(ParentImage="*\\taskeng.exe" OR ParentImage="*\\taskhostw.exe" OR ParentImage="*\\svchost.exe")
| eval RunTime=_time
| table host, RunTime, Image, CommandLine
]
| where (RunTime - ConfigTime) >= 0 AND (RunTime - ConfigTime) <= 86400
| table ConfigTime, host, TargetFilename, RunTime, Image, CommandLine
| sort - ConfigTimeHunt for cloud CLI commands referencing a storage destination (S3 bucket, Azure blob container, GCS bucket) that is not present in a maintained allowlist of approved corporate storage destinations. Requires and depends on keeping the KnownGoodBuckets/allowlist current — treat this as the highest-signal, lowest-volume hunt once the allowlist is populated for your environment.
// Hunt: aws s3 sync / azcopy / rclone / gsutil commands referencing a bucket or container name not present in a known-good allowlist
let KnownGoodBuckets = dynamic(["df00tech-backups-prod", "corp-approved-storage"]);
DeviceProcessEvents
| where Timestamp > ago(14d)
| where FileName in~ ("aws.exe", "azcopy.exe", "rclone.exe", "gsutil.exe")
| where ProcessCommandLine has_any ("s3://", "blob.core.windows.net", ":", "gs://")
| extend BucketRef = extract(@"(s3://[a-zA-Z0-9\-\.]+|gs://[a-zA-Z0-9\-\.]+|[a-zA-Z0-9\-]+\.blob\.core\.windows\.net)", 0, ProcessCommandLine)
| where isnotempty(BucketRef)
| where not(BucketRef has_any (KnownGoodBuckets))
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, BucketRef
| sort by Timestamp descindex=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
(Image="*\\aws.exe" OR Image="*\\azcopy.exe" OR Image="*\\rclone.exe" OR Image="*\\gsutil.exe")
(CommandLine="*s3://*" OR CommandLine="*blob.core.windows.net*" OR CommandLine="*gs://*")
NOT (CommandLine="*df00tech-backups-prod*" OR CommandLine="*corp-approved-storage*")
| table _time, host, User, Image, CommandLine
| sort - _timeAtomic Red Team Tests
Creates a Windows scheduled task that runs every 30 minutes and invokes rclone sync targeting a locally-defined remote, simulating an adversary configuring a recurring cloud-storage exfiltration job via rclone under Task Scheduler. Uses a local filesystem remote as the destination to keep the test safe and self-contained.
Command
schtasks /create /sc MINUTE /mo 30 /tn "CloudBackupSync" /tr "cmd.exe /c rclone sync C:\Users\Public\Documents C:\Windows\Temp\rclone-test-remote" /ru SYSTEM /fCleanup
schtasks /delete /tn "CloudBackupSync" /f && rmdir /s /q C:\Windows\Temp\rclone-test-remote 2>nulExpected Telemetry
Windows Security Event ID 4698 (scheduled task created) for task name 'CloudBackupSync'. Sysmon Event ID 1 for schtasks.exe process creation with '/create /sc MINUTE /mo 30' in the command line. When the task fires: Sysmon Event ID 1 for taskhostw.exe spawning cmd.exe spawning rclone.exe with 'sync' in the command line.
Expected Detection
SchedulerLaunchedCloudCLI alert fires on rclone.exe with a Task Scheduler parent chain and the 'sync' upload verb. Hunting query 1 fires if rclone.conf is created/modified shortly before this task's first run.
Runs aws s3 sync three times in succession against a local directory configured as a fake endpoint, simulating the RecurringCloudCLIUpload behavioural pattern (same tool, same account, multiple upload-verb invocations). In a live environment this would be spread across multiple days by a scheduled task; this atomic test compresses the timeline for lab validation.
Command
for /L %i in (1,1,3) do (aws s3 sync C:\Users\Public\Documents s3://df00tech-test-bucket-nonexistent --endpoint-url http://127.0.0.1:9999 2>nul & timeout /t 2)Expected Telemetry
Sysmon Event ID 1: three Process Create events for aws.exe with 's3', 'sync', and '--endpoint-url' in the command line, spaced a few seconds apart (compressed for testing; production pattern spans days). Sysmon Event ID 3: connection attempts to 127.0.0.1:9999.
Expected Detection
RecurringCloudCLIUpload alert requires ActiveDays >= 2 in production logic — this compressed atomic test validates the process/command-line matching logic but will not itself cross the multi-day threshold; extend the loop across multiple days in a persistent lab to validate the full detection end-to-end.
Creates a systemd service and timer unit that runs restic backup every 15 minutes against a local repository path formatted to resemble a remote destination, simulating T1029 implemented via systemd timers on Linux — a common persistence mechanism for scheduled data staging/exfiltration on Linux servers.
Command
sudo bash -c 'cat > /etc/systemd/system/restic-sync-test.service <<EOF
[Unit]
Description=Test restic scheduled sync
[Service]
Type=oneshot
ExecStart=/usr/bin/restic -r /tmp/restic-test-repo backup /home --password-command "echo testpass"
EOF
cat > /etc/systemd/system/restic-sync-test.timer <<EOF
[Unit]
Description=Run restic-sync-test every 15 minutes
[Timer]
OnCalendar=*:0/15
[Install]
WantedBy=timers.target
EOF
systemctl daemon-reload && systemctl enable --now restic-sync-test.timer'Cleanup
sudo systemctl disable --now restic-sync-test.timer && sudo rm -f /etc/systemd/system/restic-sync-test.service /etc/systemd/system/restic-sync-test.timer && sudo systemctl daemon-reload && rm -rf /tmp/restic-test-repoExpected Telemetry
Auditd or Sysmon-for-Linux: file write events for /etc/systemd/system/restic-sync-test.service and .timer. Process execution events for systemctl with 'daemon-reload' and 'enable --now'. When the timer fires: execve event for restic with 'backup' argument, PPID belonging to systemd.
Expected Detection
SIEM rules watching /etc/systemd/system/*.timer creation (via auditd -w rule) detect the persistence artifact. Process-level detection of restic spawned under a systemd unit context with 'backup' verb matches the scheduled-transfer behavioural pattern described in this detection, adapted for Linux telemetry sources.
Related Detections
Tactic Hub
Detection Variants (3)
Different telemetry and tradecraft for the same technique — pick the one that matches the data you collect.
- THREAT-ArchiveStaging-ScheduledExfilScheduled Batch Exfiltration of Compressed Archive StagingUse for archive staging — rar/7z multi-volume splitting ahead of a timed transfer, typical of ransomware double-extortion.
- THREAT-Exfil-ScheduledBulkTransferScheduled Off-Hours Bulk Data TransferUse for network-side detection — off-hours bulk-volume NetFlow, when you have no endpoint scheduler visibility.
- THREAT-Exfiltration-LinuxCronScheduledExfilScheduled Data Exfiltration via Linux Cron JobsUse for Linux hosts — cron/systemd-timer job creation correlated with auditd execution and outbound transfer.