huntrule

Suspicious Scheduled Task Creation for rclone Exfiltration by The Gentlemen RaaS (via process_creation)

PremiumReviewedSigma · High · v1
Category
process_creation
Author
HuntRule
Published
2026-09-26
Updated
2026-09-26
AnalysisDetection

ATT&CK techniques

Execution → Exfiltration

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule detects schtasks creating a task that references rclone, matching The Gentlemen ransomware operators who register a SafeSync scheduled task to run rclone.ps1 for automated data exfiltration. The task provides persistence and hands-off staging of stolen data to attacker cloud storage. Detecting it exposes exfiltration setup before bulk data leaves the network.

Reporting behind it

Related detections9 linkedT1053.005 — drag to rearrange
Suspicious Scheduled Task Creation via schtasks
Malicious Scheduled Task Masquerading as svchost by Estate Ransomware
Suspicious High-Frequency Scheduled Task Persistence via schtasks
Suspicious Scheduled Task Executing Binary from User-Writable Directory
Suspicious Scheduled Task Created to Run at System Startup
Suspicious Masquerading Scheduled Task Impersonating Microsoft Edge Update
Suspicious Scheduled Task With TimeSync Masquerade via Interlock RAT (via process_creation)
Malicious Webworm MicrosoftSSHUpdate Scheduled Task Persistence
Malicious LongNosedGoblin OneDrive Reporting Task Scheduled Task Persistence
Suspicious Scheduled Task Creation for rclone Exfiltration by The Gentlemen RaaS (via process_creation)
Pivot detection · T1053.005 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.