All Detections

Rclone Data Exfiltration to Wasabi Cloud Storage

avatar
Elgonad .@elgonad
updated Mar 5, 202650110

Detects the use of Rclone to exfiltrate data to a Wasabi cloud storage bucket. This technique was observed being used by the Iranian APT group Seedworm.

Sigma