Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
63 detections
Filters
Last updated
All Time
Detection languages
27
8
7
6
6
Contributors
19
10
8
5
4
Categories
59
35
15
14
7
Platforms
51
8
7
6
5
Products / Services
18
14
12
6
6
MITRE Techniques
18,114
15,633
12,576
8,388
6,215
IDS Classtypes
6
IDS Protocols
6
This rule detects the execution of cloud transfer tools such as rclone, WinSCP, Dropbox, OneDrive, or curl.exe when their command line arguments indicate the transfer of mailbox-related files (PST, OST, or temporary files with 'ts_' prefix) and include keywords like 'copy', 'sync', 'put', 'upload', or 'transfer'. The rule focuses on the causality chain to identify the actor and processes involved in such activities, which could indicate data exfiltration.
Targets mailbox export naming and immediate use of cloud transfer tools such as rclone, WinSCP, Dropbox, or OneDrive. The UDM rule retains principal and target context for correlation.
This rule detects unusually large network uploads from devices. It identifies successful network connections where individual transfers exceed 100MB and aggregates these transfers by account name and hour. The rule then flags any account that has uploaded a total of 1TB or more within a single hour. This pattern could indicate data exfiltration, unauthorized data synchronization, or other malicious activities involving significant data transfer volumes.
Detects the execution of WinSCP or Rclone binaries, which are frequently used by threat actors like UNC3753 to exfiltrate staged data. This rule specifically looks for process creation events where the image name is 'winscp.exe' or 'rclone.exe'.
This rule detects unusually large network uploads from devices. It identifies successful network connections where individual transfers exceed 100MB and aggregates these transfers by account name and hour. The rule then flags any account that has uploaded a total of 1TB or more within a single hour. This pattern could indicate data exfiltration, unauthorized data synchronization, or other malicious activities involving significant data transfer volumes.
Detects the execution of WinSCP or Rclone binaries, which are heavily utilized by threat actors like UNC3753 as portable utilities to rapidly exfiltrate staged data.
Detects the use of Rclone to exfiltrate data to a Wasabi cloud storage bucket. This technique was observed being used by the Iranian APT group Seedworm.
This rule is meant to help analysts quickly spot a high-confidence indicator related to Google ShinyHunters SaaS Defense Guidance. It is written to be easy to understand and to keep false alarms low by focusing on a very specific match: rclone used with copy/sync style commands to move data to a remote destination. A match does not automatically prove an attacker is currently active, and it does not prove a file was executed, but it does mean the event is important because it lines up with a public threat intelligence source. When this triggers, start by identifying the host, user, and timeframe involved, then decide whether the activity is expected for that system. If it is unexpected, preserve the related logs and any files, and look for nearby events that could explain how the indicator appeared, such as a download, a new process, or a new connection. If the same indicator appears on multiple systems, treat it as a scoping signal and expand the investigation window. Use the reference link (https://cloud.google.com/blog/topics/threat- intelligence/defense-against-shinyhunters-cybercrime-saas) to document where the indicator came from and to support incident notes and reporting.
This rule detects the creation of 'rclone.conf' file on a device. The 'rclone.conf' file is a configuration file used by the Rclone utility, a command-line program for syncing files with various cloud storage services. The presence of this file often indicates the installation or use of Rclone, which can be leveraged by adversaries for data exfiltration to cloud storage.
Detects the use of a renamed Rclone binary to exfiltrate data via FTP. This technique was observed in a Lunar Spider intrusion where the actor used 'sihosts.exe' (a renamed rclone.exe) to copy files to an actor-controlled FTP server.
The following analytic detects the usage of `rclone.exe` with specific command-line arguments indicative of file transfer activities. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions and process details. This activity is significant as `rclone.exe` is often used by adversaries for data exfiltration, especially during ransomware attacks. If confirmed malicious, this behavior could lead to unauthorized data transfer, resulting in data breaches and potential loss of sensitive information. Immediate isolation of the affected endpoint and further investigation are recommended.
Detects the use of the rclone tool with data transfer commands (copy, move, sync, copyto, moveto) originating from a GoAnywhere server process or common interactive shell processes (cmd.exe, powershell.exe). This activity is highly suspicious and could indicate data exfiltration.
This detection identifies execution of the file synchronization utility "rclone" with network activity, as captured by Cisco Network Visibility Module flow data. It specifically looks for `rclone.exe` or `rclone` commands with arguments indicative of data transfer to cloud storage providers (e.g., `copy`, `remote:`, `mega:`, `ftp:`) and suspicious flags (`--transfers`, `--ignore-existing`, `--auto-confirm`). Rclone is a legitimate tool but is frequently abused by threat actors for data exfiltration or cloud abuse.
Microsoft has observed Bazacall using a renamed version of Rclone for data exfiltration.
This query looks for user content downloads from dropbox that originate from a link/redirect from a 3rd party site.
File sharing sites such as Dropbox are often used for hosting malware on a reputable site.
Read more about download URL data and about this attack vector in this blog post:.
Https://techcommunity.microsoft.com/t5/Threat-Intelligence/Hunting-tip-of-the-month-Browser-downloads/td-p/220454.
Tags: #DownloadUrl, #Referer, #Dropbox.
File sharing sites such as Dropbox are often used for hosting malware on a reputable site.
Read more about download URL data and about this attack vector in this blog post:.
Https://techcommunity.microsoft.com/t5/Threat-Intelligence/Hunting-tip-of-the-month-Browser-downloads/td-p/220454.
Tags: #DownloadUrl, #Referer, #Dropbox.
This analytic detects the execution of a renamed `rclone.exe` process, which is commonly used for data exfiltration to remote destinations. This detection leverages Endpoint Detection and Response (EDR) telemetry, focusing on process names and original file names that do not match. This activity is significant because ransomware groups often use RClone to exfiltrate sensitive data. If confirmed malicious, this behavior could indicate an ongoing data exfiltration attempt, potentially leading to significant data loss and further compromise of the affected systems.
Detects the execution of the Rclone utility, which is often used by ransomware strains like REvil, Conti, and FiveHands for data exfiltration to cloud storage services. The rule looks for specific command-line arguments and image names associated with Rclone.
Detects the use of rclone, a command-line program to manage files on cloud storage, by identifying its default user-agent string in proxy logs. This activity can indicate data exfiltration to cloud storage services.
Detects DNS queries for subdomains related to the MEGA cloud storage service. This activity can indicate data exfiltration to cloud storage, potentially using tools like Rclone.
This rule detects DNS queries for subdomains associated with the MEGA cloud storage service, specifically 'userstorage.mega.co.nz'. Such queries can indicate attempts to exfiltrate data to MEGA, potentially using tools like Rclone, or legitimate usage of the service. The rule focuses on the DNS layer to identify communication with this cloud storage provider.
Detects the creation of Rclone configuration files, which are typically stored in a specific user directory path. Rclone is a command-line program used for syncing files with various cloud storage services and is often leveraged by adversaries for data exfiltration.
Page 3 of 3