Data Exfil - Rclone/MegaSync Anomalous Execution (T1567.002)

Ibrahim Saud@tektrix

•updated Jun 23, 2026•6•0•4

Correlates the execution of known data exfiltration utilities (rclone, mega-cmd, filezilla) passing configuration files or remote cloud repository targets dynamically.