Rule name: "Skopnix: rclone copy or sync to remote storage (T1567.002)"
Rule type: Event
Test stack:
  - and when the event(s) were detected by one or more of [Microsoft Windows Security Event Log, Microsoft Windows Sysmon]
  - and when the event matches this AQL filter query: "Process Name" ILIKE 'rclone.exe' AND ("Process CommandLine" ILIKE '% copy %' OR "Process CommandLine" ILIKE '% sync %')
Response: dispatch new event / create offense indexed by Source IP; annotate "Skopnix T1567.002".
FP-safety: Matches only rclone running copy/sync; listing, config and mount do not match. Renamed rclone binaries are not covered by the Cortex/QRadar versions (Sigma also checks the PE description).