• CommunityEnterprisePlans
  • Intel Exchange
    Intel ExchangeDetections
  • Resources
  • About
  • Leaderboard
Join CommunitySign In
    All Detections

    Rclone Bulk Transfer Command

    avatar
    GlassDiceBearhttps://www.dicebear.comhttps://creativecommons.org/publicdomain/zero/1.0/„Glass” (https://www.dicebear.com) by „DiceBear”, licensed under „CC0 1.0” (https://creativecommons.org/publicdomain/zero/1.0/)
    Daniel Jeremiah@daniyyell
    •updated Jun 19, 2026•0•0•4

    Detects rclone copy, sync, move, or copyto operations with options commonly used for unattended bulk transfer, indicating potential data exfiltration to cloud storage.

    Microsoft Sentinel (KQL)

    Tags

    T1567.002 - Exfiltration to Cloud StorageT1020 - Automated ExfiltrationTA0010 - ExfiltrationCommand ExecutionData ExfiltrationProcess CreationWindowsLinuxmacOSAzure Sentinelkql

    Community Inspired.
    AI Enhanced.
    Better Detections.

    Follow Us

    Company

    • About
    • Leaderboard

    Product

    • Community
    • Enterprise
    • Plans

    © 2026 Copyright. All Rights Reserved.

    Privacy PolicyTerms of Service

    Sign up to view this detection

    or

    Already have an account?