Windows: Rclone Configuration File Creation via rclone config path

Alerts on creation of rclone config files under a Windows user profile path.

FreeReviewedSigma · Medium · v2

Product: windows
Category: file_event
Author: Aaron Greetham (@beardofbinary) - NCC Group (SigmaHQ), DRL 1.1
Published: 2021-05-26
Updated: 2026-07-31

ATT&CK techniques

Exfiltration

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
- T1567.002Exfiltration to Cloud Storage
Impact

What it detects

This rule identifies creation of files under typical rclone configuration locations on Windows, specifically paths containing '\.config\rclone\' within a user profile directory. Creating rclone config files can be used to stage access credentials and endpoints for file transfer and potential exfiltration. It relies on Windows file event telemetry that records the target file path for the creation event.

Reporting behind it

Related detections9 linkedT1567.002 — drag to rearrange

Suspicious Data Exfiltration to Telegram or Discord Web Service

Suspicious ALPHA SPIDER Rclone Exfiltration Tool Masquerading as System Binary (via process_creation)

Malicious GhostLocker2 C2 Communication via HTTP POST (via proxy)

Suspicious Rclone Exfiltration Masquerading as wininit.exe

Malicious Bulk Data Exfiltration via Rclone (via process_creation)

Rclone SMB Share Exfiltration

Suspicious Data Exfiltration via Rclone to Cloud Storage (via process_creation)

Malicious Data Exfiltration via MEGAcmd

Suspicious Command and Control via Discord or Telegram Bot API

Windows: Rclone Configuration File Creation via rclone config path

Pivot detection · T1567.002 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-rclone-configuration-file-creation-in-user-profile-34986307

title: "Windows: Rclone Configuration File Creation via rclone config path"
id: 365e061a-2652-44eb-b823-8fa179be82a9
status: test
description: This rule identifies creation of files under typical rclone configuration locations on Windows, specifically paths containing '\.config\rclone\' within a user profile directory. Creating rclone config files can be used to stage access credentials and endpoints for file transfer and potential exfiltration. It relies on Windows file event telemetry that records the target file path for the creation event.
references:
  - https://research.nccgroup.com/2021/05/27/detecting-rclone-an-effective-tool-for-exfiltration/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_rclone_config_files.yml
author: Aaron Greetham (@beardofbinary) - NCC Group, Huntrule Team
date: 2021-05-26
modified: 2023-05-09
tags:
  - attack.exfiltration
  - attack.t1567.002
logsource:
  product: windows
  category: file_event
detection:
  selection:
    TargetFilename|contains|all:
      - :\Users\
      - \.config\rclone\
  condition: selection
falsepositives:
  - Legitimate Rclone usage
level: medium
license: DRL-1.1
related:
  - id: 34986307-b7f4-49be-92f3-e7a4d01ac5db
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL