Adversaries may use rclone with a specific user-agent string to exfiltrate data or move laterally through a network by disguising malicious activity as legitimate cloud storage management. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify potential data exfiltration or command-and-control channels hidden within legitimate cloud storage operations.
Detection Rule
title: Rclone Activity via Proxy
id: 2c03648b-e081-41a5-b9fb-7d854a915091
status: test
description: Detects the use of rclone, a command-line program to manage files on cloud storage, via its default user-agent string
references:
- https://rclone.org/
- https://www.kroll.com/en/insights/publications/cyber/new-m365-business-email-compromise-attacks-with-rclone
author: Janantha Marasinghe
date: 2022-10-18
tags:
- attack.exfiltration
- attack.t1567.002
logsource:
category: proxy
detection:
selection:
c-useragent|startswith: 'rclone/v'
condition: selection
falsepositives:
- Valid requests with this exact user agent to that is used by legitimate scripts or sysadmin operations
level: medium
imWebSession
| where HttpUserAgent startswith "rclone/v"Scenario: Rclone Used for Backup via Scheduled Job
Description: A legitimate scheduled backup job uses rclone to sync data to a cloud storage service.
Filter/Exclusion: Exclude processes where the command line includes --backup or --sync flags, and the destination is a known backup storage location.
Scenario: Rclone Used by DevOps Toolchain (e.g., Jenkins, GitLab CI)
Description: A CI/CD pipeline uses rclone to transfer artifacts or code to a cloud storage bucket as part of the deployment process.
Filter/Exclusion: Exclude processes where the command line includes --config pointing to a known CI/CD config file, or the destination is a known artifact storage path.
Scenario: Rclone Used for File Sync Between On-Prem and Cloud
Description: An admin uses rclone to synchronize files between an on-premises file server and a cloud storage service.
Filter/Exclusion: Exclude processes where the command line includes --sync and the source/destination paths are known internal file shares or cloud storage buckets used for sync.
Scenario: Rclone Used for User-Driven File Transfer
Description: A user manually transfers files using rclone, such as moving personal documents to a personal cloud storage account.
Filter/Exclusion: Exclude processes where the command line includes --user or --password flags, and the destination is a personal cloud storage location.
Scenario: Rclone Used by a Third-Party Tool or Service
Description: A third-party service or internal tool uses rclone as part of its integration with cloud storage, such as a file management application.
Filter/Exclusion: Exclude processes where the command line includes --config pointing to a known third-party tool configuration file, or the user is