Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1 detection
Filters
Last updated
All Time
Detection languages
1
Contributors
1
Categories
1
1
Platforms
1
Products / Services
1
MITRE Techniques
18,116
15,636
12,583
8,393
6,221
Detects the execution of the Rclone utility, which is often used by ransomware strains like REvil, Conti, and FiveHands for data exfiltration to cloud storage services. The rule looks for specific command-line arguments and image names associated with Rclone.
