Windows: Rclone configuration file creation in user profile

title: "Windows: Rclone configuration file creation in user profile"
id: 365e061a-2652-44eb-b823-8fa179be82a9
status: test
description: This rule flags file creation events where the target path contains the user profile directory and the rclone configuration directory (.config\rclone). Attackers commonly create rclone config files to prepare staged connections for data transfer and potential exfiltration. Detection relies on Windows file event telemetry that includes the created/target filename or full path.
references:
  - https://research.nccgroup.com/2021/05/27/detecting-rclone-an-effective-tool-for-exfiltration/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_rclone_config_files.yml
author: Aaron Greetham (@beardofbinary) - NCC Group, Huntrule Team
date: 2021-05-26
modified: 2023-05-09
tags:
  - attack.exfiltration
  - attack.t1567.002
logsource:
  product: windows
  category: file_event
detection:
  selection:
    TargetFilename|contains|all:
      - :\Users\
      - \.config\rclone\
  condition: selection
falsepositives:
  - Legitimate Rclone usage
level: medium
license: DRL-1.1
related:
  - id: 34986307-b7f4-49be-92f3-e7a4d01ac5db
    type: derived