Rclone, MEGAsync, WinSCP or 7z/rar Staging and Exfiltration Before Ransomware

Suraj A@cytech

•updated yesterday•1•0•3

Detects process creation of data exfiltration tools (Rclone, MEGAsync, WinSCP) and archive utilities (7z, rar) used with staging and compression arguments, which represents a common pre-ransomware data staging and exfiltration pattern.