Rclone Config File Creation

Title: Rclone Config File Creation
Status: test
Description:Detects Rclone config files being created
References:
  -https://research.nccgroup.com/2021/05/27/detecting-rclone-an-effective-tool-for-exfiltration/
Author: Aaron Greetham (@beardofbinary) - NCC Group
Date: 2021-05-26
modified:2023-05-09
Tags:

• -'attack.exfiltration'
• -'attack.t1567.002'

Logsource:

• product: windows
• category: file_event

Detection:
  selection:
    TargetFilename|contains|all:
      -':\Users\'
      -'\.config\rclone\'

  condition:selection
Falsepositives:
  -Legitimate Rclone usage
Level: medium