Winscp Rclone Exfiltration Tool Execution
Detects the execution of WinSCP or Rclone binaries, which are heavily utilized by threat actors like UNC3753 as portable utilities to rapidly exfiltrate staged data.
YARA-L
Detects the execution of WinSCP or Rclone binaries, which are heavily utilized by threat actors like UNC3753 as portable utilities to rapidly exfiltrate staged data.
Already have an account?