Akira Affiliate Data Exfiltration via WinSCP or rclone to Easyupload.io / Cloud Storage
This rule monitors for the execution and network activity of known data exfiltration tools such as WinSCP, rclone, and MegaSync. It also tracks the creation of configuration files associated with these tools and monitors DNS requests and browser navigation to known cloud storage and file-sharing destinations. This behavior is indicative of data staging and unauthorized exfiltration.
SentinelOne
