Renamed Rclone (SearchApp.exe) copying file share to external SFTP
Detects rclone-style copy operations transferring data from a UNC share to an SFTP remote. It identifies malicious use by inspecting specific argument sets and handles renamed binaries (such as SearchApp.exe) masquerading as rclone.
Microsoft Sentinel (KQL)
