Qilin Data Exfiltration via Rclone or MEGAcmd Pre-Encryption
Detects the use of rclone, MEGAcmd, or common command-line tools like curl/wget to transfer data to known cloud storage endpoints (mega.nz, gofile.io, anonfiles, pixeldrain) when initiated from non-standard system paths (i.e., not 'C:\Program Files'). This rule aims to identify data exfiltration activities, particularly those associated with the Qilin threat actor's double extortion tactics.
Microsoft Sentinel (KQL)
