Renamed Rclone Exfil

Description

Microsoft has observed Bazacall using a renamed version of Rclone for data exfiltration.

Query · kql

DeviceProcessEvents 
| where ProcessVersionInfoProductName has "rclone" and not(FileName has "rclone")
Raw source Renamed Rclone Exfil · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 2b2e8b89-ba54-48f9-a24f-b9ae16a7ef6d
name: Renamed Rclone Exfil
description: |
  Microsoft has observed Bazacall using a renamed version of Rclone for data exfiltration.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceProcessEvents
tactics:
- Exfiltration
query: |
  DeviceProcessEvents 
  | where ProcessVersionInfoProductName has "rclone" and not(FileName has "rclone")

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.