Rclone Bulk Transfer Command
Detects rclone copy, sync, move, or copyto operations with options commonly used for unattended bulk transfer, indicating potential data exfiltration to cloud storage.
Microsoft Sentinel (KQL)

Detects rclone copy, sync, move, or copyto operations with options commonly used for unattended bulk transfer, indicating potential data exfiltration to cloud storage.

Already have an account?