SRG no-malware chain: RMM tool followed by WinSCP/Rclone or cloud upload on host

ills3c Intel&Coffee@Ills3C

•updated 4 days ago•0•0•6

Detects the execution of Remote Monitoring and Management (RMM) tools followed closely (within 1 day) by potential data exfiltration activity using tools like WinSCP or Rclone, or connections to cloud storage providers (OneDrive, Google Drive) from the same device.