s5cmd.exe execution from ProgramData for S3 exfiltration

Duo Tech@duotech

•updated Jul 15, 2026•1•0•4

Detects the execution of the 's5cmd' tool from the 'C:\ProgramData' directory. 's5cmd' is a common command-line tool used for interacting with object storage systems like Amazon S3 and is frequently leveraged by attackers for data exfiltration due to its efficiency.