Potential Data Exfiltration via Rclone

  1[metadata]
  2creation_date = "2026/03/18"
  3integration = ["endpoint", "windows", "sentinel_one_cloud_funnel", "m365_defender", "system", "crowdstrike"]
  4maturity = "production"
  5updated_date = "2026/09/18"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Identifies abuse of rclone (or a renamed copy, e.g. disguised as a security or backup utility) to exfiltrate data to
 11cloud storage or remote endpoints. Rclone is a legitimate file sync tool; threat actors rename it to blend with
 12administrative traffic and use copy/sync with cloud backends (e.g. :s3:) and include filters to exfiltrate specific
 13file types.
 14"""
 15from = "now-9m"
 16index = [
 17    "endgame-*",
 18    "logs-crowdstrike.fdr*",
 19    "logs-endpoint.events.process-*",
 20    "logs-m365_defender.event-*",
 21    "logs-sentinel_one_cloud_funnel.*",
 22    "logs-system.security*",
 23    "logs-windows.sysmon_operational-*",
 24    "winlogbeat-*",
 25]
 26language = "eql"
 27license = "Elastic License v2"
 28name = "Potential Data Exfiltration via Rclone"
 29note = """## Triage and analysis
 30
 31### Investigating Potential Data Exfiltration via Rclone
 32
 33Rclone is a legitimate file synchronization tool. Threat actors abuse it (often renamed, e.g. to TrendFileSecurityCheck.exe) to exfiltrate data to S3, HTTP endpoints, or other cloud backends, using `copy`/`sync` with `--include` filters and high `--transfers` to move specific file types at scale.
 34
 35### Possible investigation steps
 36
 37- Confirm the command line for `copy`/`sync`, cloud backend (e.g. `:s3:`, `:http`), and options like `--include`, `--transfers`, `-P`.
 38- If the process name is not `rclone.exe`, compare with `process.pe.original_file_name`; a mismatch indicates a renamed copy used to evade name-based detection.
 39- From the command line, identify the source path (e.g. UNC or local) and the remote backend (S3 bucket, HTTP endpoint) as the exfil destination.
 40- Review `--include`/`--exclude` and `--max-age`/`--max-size` to understand what data was targeted (documents, CAD, archives, etc.).
 41- Correlate with the process executable path (recently dropped?), parent process, and user; look for outbound network to the same backend.
 42
 43### False positive analysis
 44
 45- Legitimate backup or sync jobs using rclone from a known path and config may trigger; allowlist by process path or `--config` path for approved rclone usage.
 46
 47### Response and remediation
 48
 49- Terminate the rclone process and isolate the host if exfiltration is confirmed.
 50- Identify and revoke access to the destination (S3 bucket, API keys, etc.); preserve logs for the exfil session.
 51- Determine scope of data exposed and notify stakeholders; rotate credentials and secrets that may have been in exfiltrated paths.
 52"""
 53
 54setup = """## Setup
 55
 56This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.
 57
 58Setup instructions: https://ela.st/install-elastic-defend
 59
 60### Additional data sources
 61
 62This rule also supports the following third-party data sources. For setup instructions, refer to the links below:
 63
 64- [CrowdStrike](https://ela.st/crowdstrike-integration)
 65- [Microsoft Defender XDR](https://ela.st/m365-defender)
 66- [SentinelOne Cloud Funnel](https://ela.st/sentinel-one-cloud-funnel)
 67- [Sysmon Event ID 1 - Process Creation](https://ela.st/sysmon-event-1-setup)
 68- [Windows Process Creation Logs](https://ela.st/audit-process-creation)
 69"""
 70
 71references = [
 72    "https://attack.mitre.org/techniques/T1048/",
 73    "https://rclone.org/commands/rclone_copy/",
 74]
 75risk_score = 47
 76rule_id = "3f4c2b18-9d2e-4b7a-a3c1-8e6d9f2b5c7e"
 77severity = "medium"
 78tags = [
 79    "Domain: Endpoint",
 80    "OS: Windows",
 81    "Use Case: Threat Detection",
 82    "Tactic: Exfiltration",
 83    "Resources: Investigation Guide",
 84    "Data Source: Elastic Defend",
 85    "Data Source: Sysmon",
 86    "Data Source: SentinelOne",
 87    "Data Source: Microsoft Defender XDR",
 88    "Data Source: Crowdstrike",
 89    "Data Source: Elastic Endgame",
 90    "Data Source: Windows Security Event Logs",
 91    "Noise: Low",
 92    "Performance: Normal",
 93    "Rule Type: Event Correlation (EQL)",
 94    "Platform: Windows",
 95]
 96timestamp_override = "event.ingested"
 97type = "eql"
 98
 99query = '''
100process where host.os.type == "windows" and event.type == "start" and
101 (process.name : "rclone.exe" or ?process.pe.original_file_name == "rclone.exe") and process.args : ("copy", "sync") and
102  not process.args : ("--config=?:\\Program Files\\rclone\\config\\rclone\\rclone.conf", "--config=?:\\Program Files (x86)\\rclone\\config\\rclone\\rclone.conf") and 
103  not process.executable : ("?:\\Program Files*", "\\Device\\HarddiskVolume*\\Program Files*")
104'''
105
106
107[[rule.threat]]
108framework = "MITRE ATT&CK"
109
110[[rule.threat.technique]]
111id = "T1048"
112name = "Exfiltration Over Alternative Protocol"
113reference = "https://attack.mitre.org/techniques/T1048/"
114
115[[rule.threat.technique]]
116id = "T1567"
117name = "Exfiltration Over Web Service"
118reference = "https://attack.mitre.org/techniques/T1567/"
119
120[[rule.threat.technique.subtechnique]]
121id = "T1567.002"
122name = "Exfiltration to Cloud Storage"
123reference = "https://attack.mitre.org/techniques/T1567/002/"
124
125[rule.threat.tactic]
126id = "TA0010"
127name = "Exfiltration"
128reference = "https://attack.mitre.org/tactics/TA0010/"
129
130[[rule.threat]]
131framework = "MITRE ATT&CK"
132
133[[rule.threat.technique]]
134id = "T1036"
135name = "Masquerading"
136reference = "https://attack.mitre.org/techniques/T1036/"
137
138[[rule.threat.technique.subtechnique]]
139id = "T1036.003"
140name = "Rename Legitimate Utilities"
141reference = "https://attack.mitre.org/techniques/T1036/003/"
142
143[rule.threat.tactic]
144id = "TA0005"
145name = "Defense Evasion"
146reference = "https://attack.mitre.org/tactics/TA0005/"