Command-Line Data Exfiltration Utilities
Dual-use transfer tools (rclone, WinSCP, curl, AzCopy, AWS/gcloud CLI) are favored by ransomware affiliates and APT operators because they are signed/legitimate. The hunt keys on upload-oriented flags and verbs per tool, not binary presence. Each tool has its own
CQL
