Rclone Cloud Exfiltration Following QEMU Activity

nomit vyas@xoxo

•updated Jun 25, 2026•1•0•6

This rule detects the use of Rclone for cloud file synchronization or configuration file creation on endpoints that have shown recent activity related to QEMU virtualization. The detection correlates process execution or file creation events involving Rclone with prior QEMU execution within a 24-hour window, which may indicate an adversary using virtualization to stage or exfiltrate data.