detection.wiki

Detection rules › Sigma

Rclone Config File Creation

Status
test
Severity
medium
Log source
product windows, category file_event
Author
Aaron Greetham (@beardofbinary) - NCC Group
Source
github.com/SigmaHQ/sigma

Detects Rclone config files being created

MITRE ATT&CK coverage

TacticTechniques
ExfiltrationT1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage

Event coverage

ProviderEventTitle
SysmonEvent ID 11FileCreate

Rule body yaml

title: Rclone Config File Creation
id: 34986307-b7f4-49be-92f3-e7a4d01ac5db
status: test
description: Detects Rclone config files being created
references:
    - https://research.nccgroup.com/2021/05/27/detecting-rclone-an-effective-tool-for-exfiltration/
author: Aaron Greetham (@beardofbinary) - NCC Group
date: 2021-05-26
modified: 2023-05-09
tags:
    - attack.exfiltration
    - attack.t1567.002
logsource:
    product: windows
    category: file_event
detection:
    selection:
        TargetFilename|contains|all:
            - ':\Users\'
            - '\.config\rclone\'
    condition: selection
falsepositives:
    - Legitimate Rclone usage
level: medium

Stages and Predicates

Stage 0: condition

selection

Stage 1: selection

selection:
    TargetFilename|contains|all:
        - ':\Users\'
        - '\.config\rclone\'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
TargetFilenamematch
  • :\Users\ corpus 4 (sigma 4)
  • \.config\rclone\