PUA - Rclone Execution

Title: PUA - Rclone Execution
Status: test
Description:Detects execution of RClone utility for exfiltration as used by various ransomwares strains like REvil, Conti, FiveHands, etc
References:
  -https://research.nccgroup.com/2021/05/27/detecting-rclone-an-effective-tool-for-exfiltration/
  -https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware
  -https://us-cert.cisa.gov/ncas/analysis-reports/ar21-126a
  -https://labs.sentinelone.com/egregor-raas-continues-the-chaos-with-cobalt-strike-and-rclone
  -https://www.splunk.com/en_us/blog/security/darkside-ransomware-splunk-threat-update-and-detections.html
Author: Bhabesh Raj, Sittikorn S, Aaron Greetham (@beardofbinary) - NCC Group
Date: 2021-05-10
modified:2023-03-05
Tags:

• -'attack.exfiltration'
• -'attack.t1567.002'

Logsource:

• product: windows
• category: process_creation

Detection:
  selection_specific_options:
    CommandLine|contains|all:
      -'--config '
      -'--no-check-certificate '
      -' copy '

  selection_rclone_img:
Image|endswith:'\rclone.exe' Description:'Rsync for cloud storage'   selection_rclone_cli:
    CommandLine|contains:
      -'pass'
      -'user'
      -'copy'
      -'sync'
      -'config'
      -'lsd'
      -'remote'
      -'ls'
      -'mega'
      -'pcloud'
      -'ftp'
      -'ignore-existing'
      -'auto-confirm'
      -'transfers'
      -'multi-thread-streams'
      -'no-check-certificate '

  condition:selection_specific_options or all of selection_rclone_*
Falsepositives:
  -Unknown
Level: high