Rclone Bulk S3 PutObject Bursts via CloudTrail

Arnold Chan@slaz

•updated Sep 12, 2026•0•0•0

Detects high-frequency S3 object upload activity (PutObject/CompleteMultipartUpload) originating from the Rclone tool, a common indicator of potential data exfiltration to cloud storage.