THREAT-Exfil-MEGAcmdCloudStorageUpload Elastic Security · Elastic

Detect Data Exfiltration to MEGA Cloud Storage via MEGAcmd / MEGAsync CLI in Elastic Security

MEGA (mega.nz / mega.io) offers end-to-end encrypted cloud storage with a free 20 GB tier, anonymous sign-up, and the signed command-line tools MEGAcmd (mega-login, mega-put, mega-sync, mega-exec, MEGAcmdServer) and MEGAsync. Ransomware and data-extortion operators favour them because uploaded content is client-side encrypted (the provider and defenders cannot inspect it), the clients are legitimate and signed, and the traffic is TLS to *.mega.nz / *.mega.co.nz / g.api.mega.co.nz that blends into normal web usage. Operators typically stage archives (7-Zip, WinRAR, rclone) then run `mega-login <throwaway account>` followed by `mega-put -c <archive> /remote` or `mega-sync`, often from a server or file-share host that has no business running a consumer storage client. This detection is distinct from the generic rclone cloud-sync rule (automated exfil, T1020) and from the browser-based web-service upload rules: it keys on the MEGAcmd/MEGAsync binaries (including renamed copies via PE OriginalFileName), their CLI verbs, and sustained outbound sessions to MEGA infrastructure by a non-browser process. Exfiltration over web service to an attacker-controlled cloud account maps to T1567.002.

MITRE ATT&CK

Tactic
Exfiltration

Elastic Detection Query

Elastic Security (Elastic)
eql 
any where
  (event.category == "process" and event.type == "start" and
    (process.pe.original_file_name : ("MEGAcmdShell.exe","MEGAclient.exe","MEGAcmdServer.exe","MEGAsync.exe") or
     process.name : ("MEGAclient.exe","mega-put","mega-cmd","megatools") or
     process.command_line : ("*mega-login*","*mega-put*","*mega-sync*"))) or
  (event.category == "network" and
    dns.question.name : ("*.mega.nz","*.mega.io","*.mega.co.nz") and
    not process.name : ("chrome.exe","msedge.exe","firefox.exe","brave.exe"))
high severity high confidence

Matches MEGAcmd/MEGAsync process starts (original filename, name, CLI verbs) or DNS lookups to MEGA domains from non-browser processes.

Data Sources

Elastic Defend / Sysmon process and network events

Required Tables

logs-endpoint.events.process-*logs-endpoint.events.network-*

False Positives & Tuning

  • Users or IT staff with an approved MEGA business account syncing non-sensitive data - exclude by device group and account after inventory
  • Backup or migration projects that deliberately stage data on MEGA - document and time-box the exclusion
  • Developers testing the MEGAcmd tool on lab hosts

Other platforms for THREAT-Exfil-MEGAcmdCloudStorageUpload

Microsoft Sentinel (KQL) Splunk (SPL) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1 MEGAcmd client invocation help (Windows)

    Expected signal: Sysmon EID 1 / DeviceProcessEvents for MEGAclient.exe with OriginalFileName MEGAclient.exe.

  2. Test 2 DNS and TLS contact with MEGA API by a non-browser process (Linux)

    Expected signal: DNS query for g.api.mega.co.nz and an outbound TLS connection from curl.

  3. Test 3 mega-put style command line (Windows, simulated)

    Expected signal: Process creation with command line containing mega-login and mega-put.

Last updated: 2026-10-18 Research depth: deep
References (5)

Response Playbook

Triage

  1. Confirm whether the host/user has an approved MEGA business account or MEGAsync deployment; if not, treat as unauthorised.
  2. Review the full command line: mega-login with an email, mega-put/-sync targets and the local path being uploaded (archive names such as data.7z, backup.rar).
  3. Check the binary path and signature - drops in %TEMP%, %ProgramData%, C:\Users\Public or a renamed MEGAclient.exe indicate an operator.
  4. Correlate with prior staging: archive creation (7z/rar/rclone) and large file reads in the preceding hours on the same host.
  5. Check the parent process - a remote shell, PsExec/WMI or RMM tool launching the client strongly suggests hands-on-keyboard activity.
  6. Look for ~/.megaCmd or %LOCALAPPDATA%\MEGAcmd session state to identify the destination account and uploaded paths.

Containment

  1. Network-isolate the host via EDR; MEGA use on a server often precedes ransomware detonation.
  2. Block mega.nz, mega.io, mega.co.nz and g.api.mega.co.nz at proxy/DNS/firewall (including MEGA API hostnames) and sinkhole them in DNS.
  3. Kill the MEGAcmd server/client processes and preserve the command line and memory before termination.
  4. Hunt for the same binary hash, archive names and destination account on other hosts.
  5. Report the account to MEGA abuse for takedown and engage legal/breach-notification teams if sensitive data left.

Evidence Collection

  1. MEGAclient/MEGAcmd binary, hash, signature status and OriginalFileName
  2. MEGAcmd session/log files (%LOCALAPPDATA%\MEGAcmd\megacmdserver.log, ~/.megaCmd/megacmdserver.log) listing uploaded paths and the account
  3. Process creation and network connection telemetry for the upload window
  4. Staging archives and their file listings to scope exposure
  5. Proxy/firewall logs for bytes sent to MEGA hosts

Escalation Criteria

  • !Any MEGA client on a server, domain controller or file share without an approved business case.
  • !Upload volume above 1 GB or any upload of archives containing regulated or sensitive data.
  • !Presence of ransomware precursors (shadow copy deletion, EDR tampering) on the same host.
  • !Same destination account observed on more than one host.

Investigation Guide

Related Techniques

T1567.002 - Exfiltration to Cloud Storage (parent technique)T1560.001 - Archive via Utility (staging before upload)T1074.001 - Local Data StagingT1020 - Automated Exfiltration (rclone to MEGA backend)T1486 - Data Encrypted for Impact (frequent follow-on)

Forensic Artifacts

  • >MEGAcmd server log megacmdserver.log with transfer entries
  • >%LOCALAPPDATA%\MEGAcmd and %LOCALAPPDATA%\Mega Limited\MEGAsync config and sync database
  • >Prefetch entries for MEGAclient.exe / MEGAcmdServer.exe / MEGAsync.exe
  • >DNS cache and proxy logs for g.api.mega.co.nz and *.userstorage.mega.co.nz
  • >Browser history for mega.nz/file or /folder links (web upload variant)

Tuning Guidance

If MEGA is sanctioned for a team, exclude by device group and tenant-controlled account, not by process name alone, since attackers rename the binary. Keep the OriginalFileName arm unexcluded for servers. Consider a proxy volume threshold (e.g. >100 MB out to MEGA) to rank candidates.

Hunting Queries

Non-browser processes contacting MEGA domains and high-volume proxy uploads to MEGA

Hunting — KQL
kql 
DeviceNetworkEvents
| where Timestamp > ago(30d)
| where RemoteUrl has_any ("mega.nz","mega.io","mega.co.nz","userstorage.mega.co.nz")
| where InitiatingProcessFileName !in~ ("chrome.exe","msedge.exe","firefox.exe")
| summarize Conns=count(), Hosts=dcount(DeviceName) by InitiatingProcessFileName, InitiatingProcessFolderPath
| sort by Conns desc
Hunting — SPL
spl 
index=proxy dest_host IN ("*.mega.nz","*.mega.io","*.mega.co.nz")
| stats sum(bytes_out) AS bytes_out dc(src) AS hosts by user, dest_host
| where bytes_out > 104857600
| sort - bytes_out

Atomic Red Team Tests

Test 1 MEGAcmd client invocation help (Windows)
windows

Invokes MEGAclient.exe to exercise the process-creation arm without logging in or uploading. Requires MEGAcmd installed.

Command

powershell 
$p="$env:LOCALAPPDATA\MEGAcmd\MEGAclient.exe"; if(Test-Path $p){ & $p help } else { Write-Output 'MEGAcmd not installed; skipping' }

Cleanup

powershell 
Get-Process MEGAcmdServer -ErrorAction SilentlyContinue | Stop-Process -Force

Expected Telemetry

Sysmon EID 1 / DeviceProcessEvents for MEGAclient.exe with OriginalFileName MEGAclient.exe.

Expected Detection

KQL/SPL CLI arm fires on OriginalFileName match.

Test 2 DNS and TLS contact with MEGA API by a non-browser process (Linux)
linux

Uses curl to reach the MEGA API endpoint, exercising the network/DNS arm. No login or data is sent.

Command

bash 
curl -s -m 10 -o /dev/null -w '%{http_code}\n' https://g.api.mega.co.nz/cs || true

Cleanup

bash 
true

Expected Telemetry

DNS query for g.api.mega.co.nz and an outbound TLS connection from curl.

Expected Detection

Network/DNS arm flags a non-browser process contacting MEGA domains.

Test 3 mega-put style command line (Windows, simulated)
windows

Spawns cmd with a command line containing mega-put/mega-login verbs to exercise the command-line regex; nothing is executed against MEGA.

Command

powershell 
cmd.exe /c echo mega-login [email protected] & echo mega-put -c C:\Temp\data.7z /exfil

Cleanup

powershell 
echo done

Expected Telemetry

Process creation with command line containing mega-login and mega-put.

Expected Detection

CLI verb arm matches on the command line.

Related Detections

Tactic Hub

TA0010 Exfiltration

Detection Variants (2)

Different telemetry and tradecraft for the same technique — pick the one that matches the data you collect.

Parent Technique

T1567.002 Exfiltration to Cloud Storage

Related Techniques

T1567.002 Exfiltration to Cloud Storage T1560.001 Archive via Utility T1074.001 Local Data Staging T1020 Automated Exfiltration T1486 Data Encrypted for Impact

Same Tactic: Exfiltration

Popular Detections