Exfiltration Tool Execution (WinSCP/Rclone)
Detects the execution of WinSCP or Rclone binaries, which are frequently used by threat actors like UNC3753 to exfiltrate staged data. This rule specifically looks for process creation events where the image name is 'winscp.exe' or 'rclone.exe'.
Cortex XDR
