Command-Line Data Exfiltration Utilities

Awais Munir@iawais

•updated 3 days ago•24•2•32

Dual-use transfer tools (rclone, WinSCP, curl, AzCopy, AWS/GCloud CLI) are favored by ransomware affiliates and APT operators for exfiltration because they are signed or legitimate and blend into admin activity. This hunt keys on upload-oriented flags and sub-commands rather than binary presence, and also matches on OriginalFileName to catch renamed binaries (rclone is routinely renamed).