Automated Exfiltration — Automated Bulk Data Exfiltration via rclone Cloud-Sync Tooling

let LookbackWindow = 24h;
let RcloneCommandIndicators = dynamic([
  "rclone.conf", "--multi-thread-streams", "--transfers", "--bwlimit", "copy remote:", "sync remote:", "config create"
]);
DeviceProcessEvents
| where Timestamp > ago(LookbackWindow)
| where ProcessVersionInfoOriginalFileName =~ "rclone.exe"
    or InitiatingProcessCommandLine has_any (RcloneCommandIndicators)
    or ProcessCommandLine has_any (RcloneCommandIndicators)
| extend RenamedBinary = FileName !~ "rclone.exe" and ProcessVersionInfoOriginalFileName =~ "rclone.exe"
| project Timestamp, DeviceName, AccountName, FileName, FolderPath, ProcessVersionInfoOriginalFileName,
    ProcessCommandLine, InitiatingProcessFileName, RenamedBinary
| sort by Timestamp desc

index=sysmon OR index=edr EventCode=1
(OriginalFileName="rclone.exe" OR CommandLine="*rclone.conf*" OR CommandLine="*--multi-thread-streams*" OR CommandLine="*--transfers*" OR CommandLine="*copy remote:*" OR CommandLine="*sync remote:*")
| eval RenamedBinary=if(match(Image, "(?i)rclone\.exe$")==0 AND OriginalFileName="rclone.exe", "true", "false")
| table _time, host, user, Image, OriginalFileName, CommandLine, ParentImage, RenamedBinary
| sort - _time

process where event.type == "start" and (process.pe.original_file_name : "rclone.exe" or process.command_line : ("*rclone.conf*", "*--multi-thread-streams*", "*--transfers*", "*copy remote:*", "*sync remote:*"))

SELECT
    sourceip AS SourceIP,
    "Process Path" AS ProcessPath,
    "Command" AS CommandLine,
    "Username" AS Username,
    starttime AS EventTime
FROM events
WHERE
    ("Command" ILIKE '%rclone.conf%' OR "Command" ILIKE '%--multi-thread-streams%' OR "Command" ILIKE '%--transfers%' OR "Command" ILIKE '%copy remote:%' OR "Command" ILIKE '%sync remote:%')
    AND starttime > (NOW() - 86400000)
ORDER BY starttime DESC

_sourceCategory=endpoint/process
| parse "host=*," as host nodrop
| parse "CommandLine=*," as command_line nodrop
| parse "OriginalFileName=*," as original_file_name nodrop
| where original_file_name matches "rclone.exe" or command_line matches "*rclone.conf*" or command_line matches "*--multi-thread-streams*" or command_line matches "*--transfers*"
| count as ExecutionCount by host, command_line
| sort by ExecutionCount desc

rule rclone_automated_exfiltration {
  meta:
    author = "Detection Engineering"
    description = "Detects execution of rclone (including renamed copies, via command-line indicators) with cloud-sync transfer flags, consistent with ransomware-affiliate automated bulk exfiltration."
    mitre_attack_tactic = "Exfiltration"
    mitre_attack_technique = "T1020"
    severity = "HIGH"
    priority = "HIGH"

  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    $e.target.process.command_line = /rclone\.conf|--multi-thread-streams|--transfers|copy remote:|sync remote:/ nocase
    $proc = $e.target.process.file.full_path
    $cmd = $e.target.process.command_line

  match:
    $proc over 1h

  outcome:
    $execution_count = count($e.metadata.id)

  condition:
    $e and $execution_count >= 1
}

#event_simpleName=ProcessRollup2
| OriginalFilename="rclone.exe"
or regex(field=CommandLine, regex="(?i)(rclone\.conf|--multi-thread-streams|--transfers|copy remote:|sync remote:)")
| groupBy([ComputerName, FileName, OriginalFilename, CommandLine], function=count(as=ExecutionCount))
| sort(field=ExecutionCount, order=desc)