Cloud Storage Exfiltration via rclone or MEGAsync Tools
Detects the execution of known cloud storage synchronization and transfer tools (rclone, MEGA) often used by adversaries to exfiltrate data from an endpoint to unauthorized cloud storage providers. The rule specifically flags these tools when they are not running from their standard installation directories or are not digitally signed by verified publishers.
SentinelOne
