Skip to content

Hide Navigation Hide TOC

Rclone Activity via Proxy (2c03648b-e081-41a5-b9fb-7d854a915091)

Detects the use of rclone, a command-line program to manage files on cloud storage, via its default user-agent string

Cluster A Galaxy A Cluster B Galaxy B Level
Rclone Activity via Proxy (2c03648b-e081-41a5-b9fb-7d854a915091) Sigma-Rules Exfiltration to Cloud Storage - T1567.002 (bf1b6176-597c-4600-bfcd-ac989670f96b) Attack Pattern 1
Exfiltration Over Web Service - T1567 (40597f16-0963-4249-bf4c-ac93b7fb9807) Attack Pattern Exfiltration to Cloud Storage - T1567.002 (bf1b6176-597c-4600-bfcd-ac989670f96b) Attack Pattern 2