Rclone Exfiltration from GoAnywhere or Shell

Ankit Mehta@Secvyn

•updated Jun 30, 2026•1•0•4

Detects the use of the rclone tool with data transfer commands (copy, move, sync, copyto, moveto) originating from a GoAnywhere server process or common interactive shell processes (cmd.exe, powershell.exe). This activity is highly suspicious and could indicate data exfiltration.