Renamed Rclone (SearchApp.exe) copying UNC share to SFTP

ills3c Intel&Coffee@Ills3C

•updated 2 days ago•0•0•2

Detects rclone-style copy operations from a file server share to an SFTP destination, including renamed binaries such as SearchApp.exe, by matching specific command-line arguments and parameters.