Lunar Spider Rclone Ftp Exfiltration
Detects the use of a renamed Rclone binary to exfiltrate data via FTP. This technique was observed in a Lunar Spider intrusion where the actor used 'sihosts.exe' (a renamed rclone.exe) to copy files to an actor-controlled FTP server.
YARA-L
