Suspicious Rclone Config File Creation (via file_event)

title: Suspicious Rclone Config File Creation (via file_event)
id: 8ffbc70f-ef43-5e1b-9193-48d032e2028e
status: stable
description: This rule detects Rclone config files being created
references:
    - https://attack.mitre.org/techniques/T1567/002/
    - https://research.nccgroup.com/2021/05/27/detecting-rclone-an-effective-tool-for-exfiltration/
author: Huntrule Team
date: 2026-03-07
tags:
    - attack.exfiltration
    - attack.t1567.002
logsource:
    product: windows
    category: file_event
detection:
    selection:
        TargetFilename|contains|all:
            - ':\Users\'
            - '\.config\rclone\'
    condition: selection
falsepositives:
    - Unknown
level: medium