Windows: Detect Rclone command execution with exfiltration-oriented flags

title: "Windows: Detect Rclone command execution with exfiltration-oriented flags"
id: 1deb7f7f-5be8-4f11-8463-dcabf873e164
related:
  - id: a0d63692-a531-4912-ad39-4393325b2a9c
    type: obsolete
  - id: cb7286ba-f207-44ab-b9e6-760d82b84253
    type: obsolete
  - id: e37db05d-d1f9-49c8-b464-cee1a4b11638
    type: derived
status: test
description: This rule flags Windows process creation events where the command line and executable name match Rclone usage patterns commonly associated with file exfiltration. It looks for rclone.exe execution and command-line arguments that include configuration, remote targets, and transfer options such as auto-confirm, multi-thread streaming, and TLS certificate checking disabled. The detection relies on telemetry from process creation that includes the process image path/description and full command-line content.
references:
  - https://research.nccgroup.com/2021/05/27/detecting-rclone-an-effective-tool-for-exfiltration/
  - https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware
  - https://us-cert.cisa.gov/ncas/analysis-reports/ar21-126a
  - https://labs.sentinelone.com/egregor-raas-continues-the-chaos-with-cobalt-strike-and-rclone
  - https://www.splunk.com/en_us/blog/security/darkside-ransomware-splunk-threat-update-and-detections.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_pua_rclone_execution.yml
author: Bhabesh Raj, Sittikorn S, Aaron Greetham (@beardofbinary) - NCC Group, Huntrule Team
date: 2021-05-10
modified: 2023-03-05
tags:
  - attack.exfiltration
  - attack.t1567.002
logsource:
  product: windows
  category: process_creation
detection:
  selection_specific_options:
    CommandLine|contains|all:
      - "--config "
      - "--no-check-certificate "
      - " copy "
  selection_rclone_img:
    - Image|endswith: \rclone.exe
    - Description: Rsync for cloud storage
  selection_rclone_cli:
    CommandLine|contains:
      - pass
      - user
      - copy
      - sync
      - config
      - lsd
      - remote
      - ls
      - mega
      - pcloud
      - ftp
      - ignore-existing
      - auto-confirm
      - transfers
      - multi-thread-streams
      - "no-check-certificate "
  condition: selection_specific_options or all of selection_rclone_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1