Detecting Double-Extortion Staging Before Encryption

In double-extortion attacks the affiliate copies data out before encrypting it, then threatens to publish it. That theft typically happens days earlier, using ordinary tools: 7-Zip or WinRAR to bundle data, and rclone, WinSCP or a cloud-sync client to move it. Each step is observable, and catching the theft stage gives you time that catching the encryption never does.

Signals at a Glance

Tooling and Staging

Rclone is the most commonly reported exfiltration tool in ransomware cases, and it is often renamed. Detect it by behaviour: a configuration file, the verbs copy, sync or move, and a remote, rather than by file name alone:

title: Rclone Style Exfiltration Command Line
logsource:
  product: windows
  category: process_creation
detection:
  verbs:
    CommandLine|contains:
      - ' copy '
      - ' sync '
      - ' move '
  flags:
    CommandLine|contains:
      - '--config'
      - '--transfers'
      - '--no-check-certificate'
      - '--multi-thread-streams'
      - '--ignore-existing'
  remote:
    CommandLine|re: '\S+:\S*'
  named:
    Image|endswith: '\rclone.exe'
  condition: named or (verbs and flags and remote)
level: high
# tune/validate: catches renamed binaries when flags are used; allow sanctioned sync jobs.

Combine the process signal with volume. A host sending far more data to one external destination than its history, especially to a storage or file-sharing service, should rank near the top of your egress review:

// KQL - egress volume anomaly to a single destination, 24h vs 14d baseline
let window = 24h;
let baseline = DeviceNetworkEvents
    | where Timestamp between (ago(14d) .. ago(1d))
    | where ActionType == "ConnectionSuccess" and RemoteIPType == "Public"
    | summarize avgDaily=count() / 14.0 by DeviceName;
DeviceNetworkEvents
| where Timestamp > ago(window) and ActionType == "ConnectionSuccess" and RemoteIPType == "Public"
| summarize conns=count(), dests=dcount(RemoteUrl), topDest=take_any(RemoteUrl) by DeviceName, InitiatingProcessFileName
| join kind=leftouter baseline on DeviceName
| where conns > 10 * coalesce(avgDaily, 1)
| order by conns desc
// tune/validate: prefer byte counts from your proxy or firewall when available.

Closing the Window

• Alert on archive creation of server or share data by a workstation, and on archives appearing in staging directories such as a user profile, ProgramData or a temp path.
• Inventory the sanctioned sync and backup tools in your environment, so any other sync client or command-line copier stands out.
• Restrict outbound access to consumer file-sharing and anonymous object storage at the proxy, which removes the exfil path and produces a clean block signal.
• When you find staging, assume encryption is coming. Escalate to incident response, scope the intrusion and contain before the encryption stage.