Proxy Logs: Rclone User-Agent Activity via Default rclone/v Prefix

Flags proxy traffic with a user agent beginning with rclone/v, indicating rclone usage through the proxy.

FreeUnreviewedSigmamediumv1

proxy-logs-rclone-user-agent-activity-via-default-rclone-v-prefix-2c03648b

title: "Proxy Logs: Rclone User-Agent Activity via Default rclone/v Prefix"
id: 684201c3-5457-442f-8751-221af850d92f
status: test
description: This rule identifies proxy events where the client user agent starts with the rclone/v prefix, indicating rclone is being used for cloud storage file operations. Attackers may leverage rclone to move or exfiltrate data while blending into normal traffic patterns routed through proxies. The detection relies on proxy telemetry containing the HTTP user-agent field.
references:
  - https://rclone.org/
  - https://www.kroll.com/en/insights/publications/cyber/new-m365-business-email-compromise-attacks-with-rclone
  - https://github.com/SigmaHQ/sigma/blob/master/rules/web/proxy_generic/proxy_ua_rclone.yml
author: Janantha Marasinghe, Huntrule Team
date: 2022-10-18
tags:
  - attack.exfiltration
  - attack.t1567.002
logsource:
  category: proxy
detection:
  selection:
    c-useragent|startswith: rclone/v
  condition: selection
falsepositives:
  - Valid requests with this exact user agent to that is used by legitimate scripts or sysadmin operations
level: medium
license: DRL-1.1
related:
  - id: 2c03648b-e081-41a5-b9fb-7d854a915091
    type: derived

What it detects

This rule identifies proxy events where the client user agent starts with the rclone/v prefix, indicating rclone is being used for cloud storage file operations. Attackers may leverage rclone to move or exfiltrate data while blending into normal traffic patterns routed through proxies. The detection relies on proxy telemetry containing the HTTP user-agent field.

Known false positives

Valid requests with this exact user agent to that is used by legitimate scripts or sysadmin operations

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.