The Gentlemen - Scheduled Rclone Exfiltration Task

Georg Lauenstein@gsec

•updated Mar 25, 2026•0•80

Detects creation of scheduled task for rclone-based data exfiltration. The Gentlemen create a task named SafeSync that runs 'rclone.ps1' at startup with SYSTEM privileges and HIGHEST run level.