Hide Navigation Hide TOC

PUA - Rclone Execution (e37db05d-d1f9-49c8-b464-cee1a4b11638)

Detects execution of RClone utility for exfiltration as used by various ransomwares strains like REvil, Conti, FiveHands, etc

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
PUA - Rclone Execution (e37db05d-d1f9-49c8-b464-cee1a4b11638)	Sigma-Rules	Exfiltration to Cloud Storage - T1567.002 (bf1b6176-597c-4600-bfcd-ac989670f96b)	Attack Pattern	1
Exfiltration Over Web Service - T1567 (40597f16-0963-4249-bf4c-ac93b7fb9807)	Attack Pattern	Exfiltration to Cloud Storage - T1567.002 (bf1b6176-597c-4600-bfcd-ac989670f96b)	Attack Pattern	2