Rclone Cloud Exfiltration via CLI Sync/Copy + Cloud Egress
Detects the execution of the rclone utility (including renamed binaries) using command-line arguments consistent with data exfiltration or synchronization (copy, sync, move) that is followed by network communication to known cloud storage providers commonly abused for staging and exfiltration in ransomware attacks.
YARA-L
