Rclone Activity via Proxy

Title: Rclone Activity via Proxy
Status: test
Description:Detects the use of rclone, a command-line program to manage files on cloud storage, via its default user-agent string
References:
  -https://rclone.org/
  -https://www.kroll.com/en/insights/publications/cyber/new-m365-business-email-compromise-attacks-with-rclone
Author: Janantha Marasinghe
Date: 2022-10-18
modified:None
Tags:

• -'attack.exfiltration'
• -'attack.t1567.002'

Logsource:

• category: proxy

Detection:
  selection:
    c-useragent|startswith: 'rclone/v'
  condition:selection
Falsepositives:
  -Valid requests with this exact user agent to that is used by legitimate scripts or sysadmin operations
Level: medium