MinIO Client Insecure S3 Exfiltration Activity

Ethan Andrews@eandrews

•updated Jun 12, 2026•3•0•4

Detects the execution of the MinIO client (mc) with insecure connection parameters, indicating potential automated data exfiltration to S3-compatible storage by threats like BLUERABBIT. The rule specifically looks for the 'alias', 'set', and '--insecure' arguments in the process command line.