Suspicious Rclone Behavior through Proxy (via proxy)

title: Suspicious Rclone Behavior through Proxy (via proxy)
id: b8d34c73-8557-54f9-beaf-1eddb740503f
status: stable
description: This rule detects the use of rclone, a command-line program to manage files on cloud storage, via its default user-agent string
references:
    - https://attack.mitre.org/techniques/T1567/002/
    - https://rclone.org/
    - https://www.kroll.com/en/insights/publications/cyber/new-m365-business-email-compromise-attacks-with-rclone
author: Huntrule Team
date: 2026-05-31
tags:
    - attack.exfiltration
    - attack.t1567.002
logsource:
    category: proxy
detection:
    selection:
        c-useragent|startswith: 'rclone/v'
    condition: selection
falsepositives:
    - Unknown
level: medium