Rclone Activity via Proxy

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•26

Detects the use of rclone, a command-line program to manage files on cloud storage, by identifying its default user-agent string in proxy logs. This activity can indicate data exfiltration to cloud storage services.