Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
63 detections
Filters
Last updated
All Time
Detection languages
27
8
7
6
6
Contributors
19
10
8
5
4
Categories
59
35
15
14
7
Platforms
51
8
7
6
5
Products / Services
18
14
12
6
6
MITRE Techniques
18,114
15,633
12,576
8,388
6,215
IDS Classtypes
6
IDS Protocols
6
Detects high-frequency PUT requests to known S3-compatible cloud storage providers using the rclone user-agent, which is a common indicator of bulk data exfiltration or unauthorized backup activity by attackers.
Detects high-frequency PUT requests to known S3-compatible cloud storage providers using the rclone user-agent, which is a common indicator of bulk data exfiltration or unauthorized backup activity by attackers.
Detects high-frequency PUT requests to known S3-compatible cloud storage providers using the rclone user-agent, which is a common indicator of bulk data exfiltration or unauthorized backup activity by attackers.
Detects execution of RClone from non-standard directories or outbound transfer to cloud endpoints outside an approved destination list, consistent with Gunra's pre-encryption data-exfiltration tooling.
Detects the execution of the rclone utility followed by successful outbound network connections occurring outside of standard business hours (8:00 PM to 6:00 AM). Rclone is a legitimate cloud storage synchronization tool frequently abused by adversaries for data exfiltration. This pattern identifies potential unauthorized data staging and egress to remote cloud storage services during times when activity is less likely to be monitored.
This rule detects unusually large network uploads from devices. It identifies successful network connections where individual transfers exceed 100MB and aggregates these transfers by account name and hour. The rule then flags any account that has uploaded a total of 1TB or more within a single hour. This pattern could indicate data exfiltration, unauthorized data synchronization, or other malicious activities involving significant data transfer volumes.
Detects the use of the rclone tool with data transfer commands (copy, move, sync, copyto, moveto) originating from a GoAnywhere server process or common interactive shell processes (cmd.exe, powershell.exe). This activity is highly suspicious and could indicate data exfiltration.
Detects the use of the rclone tool with data transfer commands (copy, move, sync, copyto, moveto) originating from a GoAnywhere server process or common interactive shell processes (cmd.exe, powershell.exe). This activity is highly suspicious and could indicate data exfiltration.
Detects the use of rclone.exe to exfiltrate files to Dropbox, specifically looking for process execution patterns and network connections to Dropbox API endpoints consistent with the Gamaredon PteroBox exfiltration module.
Detects HTTP PUT requests directed at Wasabi Cloud Storage domains that originate from an Rclone user agent. This pattern is commonly indicative of data exfiltration activities where an attacker uses the Rclone utility to synchronize or upload sensitive data to unauthorized cloud storage.
Detects the use of legitimate command-line utilities such as rclone, AWS CLI, AzCopy, curl, and wget to upload data to cloud storage endpoints, which is a common technique used for data exfiltration.
Detects execution of rclone or the creation of an rclone configuration file (rclone.conf) occurring on a host within 24 hours of QEMU virtualization activity. This combination may indicate an adversary using virtualization software for staging or research, followed by data exfiltration via rclone to a remote cloud destination.
Detects the execution of known command-line sync tools (Rclone, MEGAsync) or commands attempting to sync or move data to various cloud storage services (s3, gdrive, onedrive, mega, dropbox). The rule focuses on executions from suspicious or temporary directory paths and excludes processes signed by trusted publishers to minimize noise.
This rule detects the use of Rclone for cloud file synchronization or configuration file creation on endpoints that have shown recent activity related to QEMU virtualization. The detection correlates process execution or file creation events involving Rclone with prior QEMU execution within a 24-hour window, which may indicate an adversary using virtualization to stage or exfiltrate data.
Detects HTTP PUT requests directed at Wasabi Cloud Storage domains that originate from an Rclone user agent. This pattern is commonly indicative of data exfiltration activities where an attacker uses the Rclone utility to synchronize or upload sensitive data to unauthorized cloud storage.
Detects the use of legitimate command-line utilities such as rclone, AWS CLI, AzCopy, curl, and wget to upload data to cloud storage endpoints, which is a common technique used for data exfiltration.
This rule monitors for the execution and network activity of known data exfiltration tools such as WinSCP, rclone, and MegaSync. It also tracks the creation of configuration files associated with these tools and monitors DNS requests and browser navigation to known cloud storage and file-sharing destinations. This behavior is indicative of data staging and unauthorized exfiltration.
Detects the execution of known command-line sync tools (Rclone, MEGAsync) or commands attempting to sync or move data to various cloud storage services (s3, gdrive, onedrive, mega, dropbox). The rule focuses on executions from suspicious or temporary directory paths and excludes processes signed by trusted publishers to minimize noise.
Detects the execution of known cloud storage synchronization and transfer tools (rclone, MEGA) often used by adversaries to exfiltrate data from an endpoint to unauthorized cloud storage providers. The rule specifically flags these tools when they are not running from their standard installation directories or are not digitally signed by verified publishers.
Detects the execution of known cloud storage synchronization and transfer tools (rclone, MEGA) often used by adversaries to exfiltrate data from an endpoint to unauthorized cloud storage providers. The rule specifically flags these tools when they are not running from their standard installation directories or are not digitally signed by verified publishers.
Targets mailbox export naming and immediate use of cloud transfer tools such as rclone, WinSCP, Dropbox, or OneDrive. The UDM rule retains principal and target context for correlation.
Page 2 of 3