Rclone exfiltration to Wasabi S3 or MEGA cloud storage

ills3c Intel&Coffee@Ills3C

•updated 2 days ago•5•0•10

Detects the execution of the rclone.exe utility with copy, sync, move, or copyto command-line arguments, correlated with outbound network connections to Wasabi S3 or MEGA cloud storage domains.