Sigma rule: PUA - Rclone Execution

Rule

Title

PUA - Rclone Execution

Status

test

Level

high

Author

Bhabesh Raj, Sittikorn S, Aaron Greetham (@beardofbinary) - NCC Group

Date

2021-05-10

Modified

2023-03-05

File

rules/windows/process_creation/proc_creation_win_pua_rclone_execution.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects execution of RClone utility for exfiltration as used by various ransomwares strains like REvil, Conti, FiveHands, etc

Log source

product

windows

category

process_creation

Detection

selection_specific_options:
    CommandLine|contains|all:
        - '--config '
        - '--no-check-certificate '
        - ' copy '
selection_rclone_img:
    - Image|endswith: '\rclone.exe'
    - Description: 'Rsync for cloud storage'
selection_rclone_cli:
    CommandLine|contains:
        - 'pass'
        - 'user'
        - 'copy'
        - 'sync'
        - 'config'
        - 'lsd'
        - 'remote'
        - 'ls'
        - 'mega'
        - 'pcloud'
        - 'ftp'
        - 'ignore-existing'
        - 'auto-confirm'
        - 'transfers'
        - 'multi-thread-streams'
        - 'no-check-certificate '
condition: selection_specific_options or all of selection_rclone_*

False positives (as the rule lists them)

• Unknown

Tags

• attack.exfiltration
• attack.t1567.002

MITRE ATT&CK ids this rule names

• T1567.002

Related rules

• a0d63692-a531-4912-ad39-4393325b2a9c (obsolete)
• cb7286ba-f207-44ab-b9e6-760d82b84253 (obsolete)

References

• https://research.nccgroup.com/2021/05/27/detecting-rclone-an-effective-tool-for-exfiltration/
• https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware
• https://us-cert.cisa.gov/ncas/analysis-reports/ar21-126a
• https://labs.sentinelone.com/egregor-raas-continues-the-chaos-with-cobalt-strike-and-rclone
• https://www.splunk.com/en_us/blog/security/darkside-ransomware-splunk-threat-update-and-detections.html

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_pua_rclone_execution.yml