Storm-1175 - Rclone Data Exfiltration (T1567.002)
Identifies Storm-1175 utilizing the rclone utility (often renamed) with MEGA or Mega-CMD configurations to exfiltrate vast data troves before encryption.
Microsoft Sentinel (KQL)
Identifies Storm-1175 utilizing the rclone utility (often renamed) with MEGA or Mega-CMD configurations to exfiltrate vast data troves before encryption.
Already have an account?