• CommunityEnterprisePlans
  • Intel Exchange
    Intel ExchangeDetections
  • Resources
  • About
  • Leaderboard
Join CommunitySign In
    All Detections

    Mailbox Export Cloud Transfer Tool Usage

    avatar
    GlassDiceBearhttps://www.dicebear.comhttps://creativecommons.org/publicdomain/zero/1.0/„Glass” (https://www.dicebear.com) by „DiceBear”, licensed under „CC0 1.0” (https://creativecommons.org/publicdomain/zero/1.0/)
    Daniel Jeremiah@daniyyell
    •updated Jun 19, 2026•4•0•9

    Targets mailbox export naming and immediate use of cloud transfer tools such as rclone, WinSCP, Dropbox, or OneDrive. The UDM rule retains principal and target context for correlation.

    YARA-L

    Tags

    S1040 - RcloneT1567 - Exfiltration Over Web ServiceT1567.002 - Exfiltration to Cloud StorageTA0010 - ExfiltrationData ExfiltrationCommand ExecutionWindows

    Community Inspired.
    AI Enhanced.
    Better Detections.

    Follow Us

    Company

    • About
    • Leaderboard

    Product

    • Community
    • Enterprise
    • Plans

    © 2026 Copyright. All Rights Reserved.

    Privacy PolicyTerms of Service

    Sign up to view this detection

    or

    Already have an account?