Rclone Remote Configuration Created from a User Writable Path

Daniel Jeremiah@daniyyell

•updated Jun 19, 2026•0•0•4

Detects rclone remote configuration or config file creation when the binary is running from a portable user writable location, such as Downloads, Temp, AppData, Desktop, /tmp/, or /var/tmp/. This activity can indicate an attempt to exfiltrate data to cloud storage services.