{"id":"e37db05d-d1f9-49c8-b464-cee1a4b11638","title":"PUA - Rclone Execution","description":"Detects execution of RClone utility for exfiltration as used by various ransomwares strains like REvil, Conti, FiveHands, etc","author":"Bhabesh Raj, Sittikorn S, Aaron Greetham (@beardofbinary) - NCC Group","status":"test","level":"high","date":"2021-05-10","modified":"2023-03-05","tags":["attack.exfiltration","attack.t1567.002"],"technique_ids":["T1567.002"],"logsource":{"product":"windows","category":"process_creation"},"falsepositives":["Unknown"],"references":["https://research.nccgroup.com/2021/05/27/detecting-rclone-an-effective-tool-for-exfiltration/","https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware","https://us-cert.cisa.gov/ncas/analysis-reports/ar21-126a","https://labs.sentinelone.com/egregor-raas-continues-the-chaos-with-cobalt-strike-and-rclone","https://www.splunk.com/en_us/blog/security/darkside-ransomware-splunk-threat-update-and-detections.html"],"source_path":"rules/windows/process_creation/proc_creation_win_pua_rclone_execution.yml","source_sha256":"23109549e2a00d4e0ac3c0389d5fdc998ae3d7aa65832c38c8e4ad811919c418","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_pua_rclone_execution.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: PUA - Rclone Execution\nid: e37db05d-d1f9-49c8-b464-cee1a4b11638\nrelated:\n    - id: a0d63692-a531-4912-ad39-4393325b2a9c\n      type: obsolete\n    - id: cb7286ba-f207-44ab-b9e6-760d82b84253\n      type: obsolete\nstatus: test\ndescription: Detects execution of RClone utility for exfiltration as used by various ransomwares strains like REvil, Conti, FiveHands, etc\nreferences:\n    - https://research.nccgroup.com/2021/05/27/detecting-rclone-an-effective-tool-for-exfiltration/\n    - https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware\n    - https://us-cert.cisa.gov/ncas/analysis-reports/ar21-126a\n    - https://labs.sentinelone.com/egregor-raas-continues-the-chaos-with-cobalt-strike-and-rclone\n    - https://www.splunk.com/en_us/blog/security/darkside-ransomware-splunk-threat-update-and-detections.html\nauthor: Bhabesh Raj, Sittikorn S, Aaron Greetham (@beardofbinary) - NCC Group\ndate: 2021-05-10\nmodified: 2023-03-05\ntags:\n    - attack.exfiltration\n    - attack.t1567.002\nlogsource:\n    product: windows\n    category: process_creation\ndetection:\n    selection_specific_options:\n        CommandLine|contains|all:\n            - '--config '\n            - '--no-check-certificate '\n            - ' copy '\n    selection_rclone_img:\n        - Image|endswith: '\\rclone.exe'\n        - Description: 'Rsync for cloud storage'\n    selection_rclone_cli:\n        CommandLine|contains:\n            - 'pass'\n            - 'user'\n            - 'copy'\n            - 'sync'\n            - 'config'\n            - 'lsd'\n            - 'remote'\n            - 'ls'\n            - 'mega'\n            - 'pcloud'\n            - 'ftp'\n            - 'ignore-existing'\n            - 'auto-confirm'\n            - 'transfers'\n            - 'multi-thread-streams'\n            - 'no-check-certificate '\n    condition: selection_specific_options or all of selection_rclone_*\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1567.002","id":"T1567.002","name":"Exfiltration to Cloud Storage","page":"techniques/enterprise/T1567.002/"}],"data_path":"data/detection-rules/e37db05d-d1f9-49c8-b464-cee1a4b11638.json","kind":"sigma"}