RClone execution from unusual locations or unapproved cloud destinations

Duo Tech@duotech

•updated Aug 10, 2026•5•0•14

Detects execution of RClone from non-standard directories or outbound transfer to cloud endpoints outside an approved destination list, consistent with Gunra's pre-encryption data-exfiltration tooling.