Skip to content
skopnix
Detections · Rule
← Sigma detectionsSigma · Behaviour (ATT&CK technique)

rclone copy or sync to remote storage (T1567.002)

SIGmediumconfidence 70/100generated 2026-10-18

rclone.exe copying or syncing data to a remote — the exfiltration tool of choice for data-theft extortion crews. Observed for: APT27, APT31, APT40, BRONZE STARLIGHT, Chimera, Confucius and 17 more.

ATT&CK
T1567.002 mitre ↗
Linked actors
APT27 · APT31 · APT40 · BRONZE STARLIGHT · Chimera · Confucius · Contagious Interview · Earth Lusca · HAFNIUM · INDRIK SPIDER · Kimsuky · LYCEUM · Medusa Group · MuddyWater · MUSTANG PANDA · POLONIUM · SaintBear · Scattered Spider · Storm-0501 · Storm-1567 · ToddyCat · Turla · WIZARD SPIDER
False positives
Matches only rclone running copy/sync; listing, config and mount do not match. Renamed rclone binaries are not covered by the Cortex/QRadar versions (Sigma also checks the PE description).

Sigma rule

skopnix-sigma-ttp-t1567-002-631ccfb6.ymldownload .yml ↓
title: Skopnix - rclone copy or sync to remote storage (T1567.002)
id: 282a819f-b1ed-5a9f-8fe1-bb473c615968
status: experimental
description: 'rclone.exe copying or syncing data to a remote — the exfiltration tool of choice for data-theft extortion crews. Observed for: APT27, APT31, APT40, BRONZE STARLIGHT, Chimera, Confucius and 17 more.'
references:
  - https://attack.mitre.org/techniques/T1567/002/
  - https://skopnix.com/actors/apt27
  - https://skopnix.com/actors/apt31
  - https://skopnix.com/actors/apt40
  - https://skopnix.com/actors/bronze-starlight
  - https://skopnix.com/actors/chimera
  - https://skopnix.com/actors/confucius
  - https://skopnix.com/actors/contagious-interview
  - https://skopnix.com/actors/earth-lusca
  - https://skopnix.com/actors/hafnium
  - https://skopnix.com/actors/indrik-spider
author: skopnix
date: '2026-10-18'
tags:
  - attack.exfiltration
  - attack.t1567.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \rclone.exe
    - Description: Rsync for cloud storage
  selection_cmd:
    CommandLine|contains:
      - ' copy '
      - ' sync '
  condition: all of selection_*
falsepositives:
  - IT teams that use rclone for sanctioned backups (whitelist the host, user and remote name)
level: medium

How to deploy on Sigma

  1. 1.Convert for your SIEM with sigma-cli / pySigma, e.g. sigma convert -t splunk -p sysmon rule.yml.
  2. 2.Run it as a hunt first: every rule ships as status experimental.
  3. 3.Promote to an alert once a week of results is clean on your data.

Check · The processing pipeline must map the logsource (firewall, dns, proxy, webserver, process_creation) to your field names.

References