Potential Data Exfiltration via Rclone

  1[metadata]
  2creation_date = "2026/03/18"
  3integration = ["endpoint", "windows", "sentinel_one_cloud_funnel", "m365_defender", "system", "crowdstrike"]
  4maturity = "production"
  5updated_date = "2026/05/04"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Identifies abuse of rclone (or a renamed copy, e.g. disguised as a security or backup utility) to exfiltrate data to
 11cloud storage or remote endpoints. Rclone is a legitimate file sync tool; threat actors rename it to blend with
 12administrative traffic and use copy/sync with cloud backends (e.g. :s3:) and include filters to exfiltrate specific
 13file types.
 14"""
 15from = "now-9m"
 16index = [
 17    "endgame-*",
 18    "logs-crowdstrike.fdr*",
 19    "logs-endpoint.events.process-*",
 20    "logs-m365_defender.event-*",
 21    "logs-sentinel_one_cloud_funnel.*",
 22    "logs-system.security*",
 23    "logs-windows.sysmon_operational-*",
 24    "winlogbeat-*",
 25]
 26language = "eql"
 27license = "Elastic License v2"
 28name = "Potential Data Exfiltration via Rclone"
 29note = """## Triage and analysis
 30
 31### Investigating Potential Data Exfiltration via Rclone
 32
 33Rclone is a legitimate file synchronization tool. Threat actors abuse it (often renamed, e.g. to TrendFileSecurityCheck.exe) to exfiltrate data to S3, HTTP endpoints, or other cloud backends, using `copy`/`sync` with `--include` filters and high `--transfers` to move specific file types at scale.
 34
 35### Possible investigation steps
 36
 37- Confirm the command line for `copy`/`sync`, cloud backend (e.g. `:s3:`, `:http`), and options like `--include`, `--transfers`, `-P`.
 38- If the process name is not `rclone.exe`, compare with `process.pe.original_file_name`; a mismatch indicates a renamed copy used to evade name-based detection.
 39- From the command line, identify the source path (e.g. UNC or local) and the remote backend (S3 bucket, HTTP endpoint) as the exfil destination.
 40- Review `--include`/`--exclude` and `--max-age`/`--max-size` to understand what data was targeted (documents, CAD, archives, etc.).
 41- Correlate with the process executable path (recently dropped?), parent process, and user; look for outbound network to the same backend.
 42
 43### False positive analysis
 44
 45- Legitimate backup or sync jobs using rclone from a known path and config may trigger; allowlist by process path or `--config` path for approved rclone usage.
 46
 47### Response and remediation
 48
 49- Terminate the rclone process and isolate the host if exfiltration is confirmed.
 50- Identify and revoke access to the destination (S3 bucket, API keys, etc.); preserve logs for the exfil session.
 51- Determine scope of data exposed and notify stakeholders; rotate credentials and secrets that may have been in exfiltrated paths.
 52"""
 53
 54setup = """## Setup
 55
 56This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.
 57
 58Setup instructions: https://ela.st/install-elastic-defend
 59
 60### Additional data sources
 61
 62This rule also supports the following third-party data sources. For setup instructions, refer to the links below:
 63
 64- [CrowdStrike](https://ela.st/crowdstrike-integration)
 65- [Microsoft Defender XDR](https://ela.st/m365-defender)
 66- [SentinelOne Cloud Funnel](https://ela.st/sentinel-one-cloud-funnel)
 67- [Sysmon Event ID 1 - Process Creation](https://ela.st/sysmon-event-1-setup)
 68- [Windows Process Creation Logs](https://ela.st/audit-process-creation)
 69"""
 70
 71references = [
 72    "https://attack.mitre.org/techniques/T1048/",
 73    "https://rclone.org/commands/rclone_copy/",
 74]
 75risk_score = 47
 76rule_id = "3f4c2b18-9d2e-4b7a-a3c1-8e6d9f2b5c7e"
 77severity = "medium"
 78tags = [
 79    "Domain: Endpoint",
 80    "OS: Windows",
 81    "Use Case: Threat Detection",
 82    "Tactic: Exfiltration",
 83    "Resources: Investigation Guide",
 84    "Data Source: Elastic Defend",
 85    "Data Source: Sysmon",
 86    "Data Source: SentinelOne",
 87    "Data Source: Microsoft Defender XDR",
 88    "Data Source: Crowdstrike",
 89    "Data Source: Elastic Endgame", 
 90    "Data Source: Windows Security Event Logs"
 91]
 92timestamp_override = "event.ingested"
 93type = "eql"
 94
 95query = '''
 96process where host.os.type == "windows" and event.type == "start" and
 97 (process.name : "rclone.exe" or ?process.pe.original_file_name == "rclone.exe") and process.args : ("copy", "sync") and
 98  not process.args : ("--config=?:\\Program Files\\rclone\\config\\rclone\\rclone.conf", "--config=?:\\Program Files (x86)\\rclone\\config\\rclone\\rclone.conf") and 
 99  not process.executable : ("?:\\Program Files*", "\\Device\\HarddiskVolume*\\Program Files*")
100'''
101
102
103[[rule.threat]]
104framework = "MITRE ATT&CK"
105
106[[rule.threat.technique]]
107id = "T1048"
108name = "Exfiltration Over Alternative Protocol"
109reference = "https://attack.mitre.org/techniques/T1048/"
110
111[[rule.threat.technique]]
112id = "T1567"
113name = "Exfiltration Over Web Service"
114reference = "https://attack.mitre.org/techniques/T1567/"
115
116[[rule.threat.technique.subtechnique]]
117id = "T1567.002"
118name = "Exfiltration to Cloud Storage"
119reference = "https://attack.mitre.org/techniques/T1567/002/"
120
121[rule.threat.tactic]
122id = "TA0010"
123name = "Exfiltration"
124reference = "https://attack.mitre.org/tactics/TA0010/"
125
126[[rule.threat]]
127framework = "MITRE ATT&CK"
128
129[[rule.threat.technique]]
130id = "T1036"
131name = "Masquerading"
132reference = "https://attack.mitre.org/techniques/T1036/"
133
134[[rule.threat.technique.subtechnique]]
135id = "T1036.003"
136name = "Rename Legitimate Utilities"
137reference = "https://attack.mitre.org/techniques/T1036/003/"
138
139[rule.threat.tactic]
140id = "TA0005"
141name = "Defense Evasion"
142reference = "https://attack.mitre.org/tactics/TA0005/"