Rclone Activity via Proxy — Sigma Rule

Rule metadata and linked tags

Author: Janantha Marasinghe. Source status: test; severity: medium. Source dates: 2022-10-18 / not supplied.

{
  "category": "proxy"
}

Pinned original Sigma rule · Detection Rule License 1.1

Source SHA-256: 3eadd02be960102969a8211f16bff79300813c8e2f7f9ebc731a8f2cf39a3c21

Detection logic

Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.

title: Rclone Activity via Proxy
id: 2c03648b-e081-41a5-b9fb-7d854a915091
status: test
description: Detects the use of rclone, a command-line program to manage files on cloud storage, via its default user-agent string
references:
    - https://rclone.org/
    - https://www.kroll.com/en/insights/publications/cyber/new-m365-business-email-compromise-attacks-with-rclone
author: Janantha Marasinghe
date: 2022-10-18
tags:
    - attack.exfiltration
    - attack.t1567.002
logsource:
    category: proxy
detection:
    selection:
        c-useragent|startswith: 'rclone/v'
    condition: selection
falsepositives:
    - Valid requests with this exact user agent to that is used by legitimate scripts or sysadmin operations
level: medium

Original YAML and metadata in JSON

False positives

• Valid requests with this exact user agent to that is used by legitimate scripts or sysadmin operations

Source references

• https://rclone.org/
• https://www.kroll.com/en/insights/publications/cyber/new-m365-business-email-compromise-attacks-with-rclone