Rule Documentation: Detection of rclone or Rsync Process Activity
Rclone File Properties
Query
DeviceProcessEvents
| where ProcessVersionInfoOriginalFileName contains "rclone" or FileName contains "rclone"
or ProcessVersionInfoFileDescription contains "Rsync"About this query
Rule Documentation: Detection of rclone or Rsync Process Activity
Description
This detection rule identifies activity related to the execution of the rclone tool or processes associated with Rsync. Both rclone and Rsync are legitimate tools commonly used for file synchronization and transfer. However, their presence or activity may also indicate potential data exfiltration or unauthorized file transfers if used maliciously.
Detection Logic
- Monitors
DeviceProcessEventsfor processes where:- The
ProcessVersionInfoOriginalFileNamecontains "rclone", or - The
FileNamecontains "rclone", or - The
ProcessVersionInfoFileDescriptioncontains "Rsync".
- The
Tags
- Execution
- File Transfer
- Data Exfiltration
- Rsync
- rclone
- Suspicious Activity
Search Query
Explanation
This query looks for activity related to the rclone tool or Rsync processes, which are commonly used for file synchronization. It monitors process events to detect any potential data exfiltration or unauthorized file transfers.
Details
Ali Hussein
Released: May 23, 2024
Tables
DeviceProcessEvents
Keywords
DeviceProcessEventsProcessVersionInfoOriginalFileNameFileNameProcessVersionInfoFileDescriptionRsyncrclone
Operators
containsorwhere