huntrule

Suspicious Rclone Exfiltration Masquerading as wininit.exe

PremiumReviewedSigma · High · v1
Product
windows
Category
process_creation
Author
HuntRule
Published
2026-09-11
Updated
2026-09-11
AnalysisDetection

ATT&CK techniques

Defense Evasion → Exfiltration

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule detects a process named wininit.exe running with Rclone-style cloud transfer arguments such as copy with remote configuration flags. Talos IR observed the Rclone exfiltration binary renamed to wininit.exe to blend with a legitimate system process while bulk-copying victim data to attacker cloud storage, so this Image and command-line mismatch flags staged exfiltration.

Reporting behind it

Related detections9 linkedT1567.002 — drag to rearrange
Suspicious Data Exfiltration to Azure Blob Storage via AzCopy (via process_creation)
Suspicious Rename of Double-Extension PowerShell Script (via process_creation)
Suspicious Cobalt Strike OCSP Malleable C2 Profile Traffic
Suspicious Spoofed Microsoft Host Header C2 by Stately Taurus
Suspicious Data Exfiltration via Rclone Cloud Transfer (via process_creation)
Suspicious Data Exfiltration to Dropbox via curl (via process_creation)
Suspicious Double Extension Image Executable by Fighting Ursa
Suspicious Lambda Function Creation Across Regions in AWS Extortion Operation
Malicious Data Exfiltration via Renamed Rclone Using Masqueraded Configuration
Suspicious Rclone Exfiltration Masquerading as wininit.exe
Pivot detection · T1567.002 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.