How do you detect rclone exfiltration?

Detect rclone on three layers. On process creation, match the sync verbs (copy, sync, move) and common flags such as --transfers and --config, and match the OriginalFileName in the PE header so a renamed binary still triggers. On the filesystem, alert on rclone.conf appearing outside an administrator’s profile, especially on servers. On the network, look for many parallel TLS sessions to a single storage provider from one process. Allowlist approved backup jobs by parent process and account to keep false positives low.

Detecting Rclone and MEGAcmd Exfiltration

Rclone supports dozens of storage back ends, runs from a single executable and is trivial to script, which is why extortion crews use it to move terabytes to Mega, S3-compatible buckets and SFTP servers. Its command lines, its configuration file and its network profile are all detectable, even when the binary is renamed.

Signals at a Glance

Signal	Where	ATT&CK
rclone verbs (`copy`, `sync`, `move`) with a remote:path argument	Sysmon 1, 4688, EDR	T1567.002
PE metadata says rclone but the file name does not	Sysmon 1 (OriginalFileName)	T1036.003
rclone.conf created or read outside an admin’s profile	Sysmon 11, file events	T1552.001
Hundreds of parallel TLS sessions to one storage provider	Zeek, firewall	T1567.002
MEGAcmd binaries (`mega-login`, `mega-put`) on a server	Process creation	T1567.002

Process and Command Line

Match on the product metadata embedded in the executable, not only on the file name. Operators routinely rename rclone to something that looks like a Windows component, but the original file name and description survive in the PE header:

title: Rclone Or Renamed Rclone Executing A Transfer
logsource:
  category: process_creation
  product: windows
detection:
  by_name:
    Image|endswith: '\\rclone.exe'
  by_metadata:
    OriginalFileName: 'rclone.exe'
  verbs:
    CommandLine|contains:
      - ' copy '
      - ' sync '
      - ' move '
      - ' copyto '
  flags:
    CommandLine|contains:
      - '--transfers'
      - '--config'
      - '--no-check-certificate'
      - '--auto-confirm'
      - '--multi-thread-streams'
  condition: (by_name or by_metadata) and (verbs or flags)
level: high
# tune/validate: allowlist approved backup jobs by parent process and account

Config and Network Artifacts

Rclone stores remotes in a file called rclone.conf, by default under the user’s roaming profile on Windows. Operators often drop a pre-built config next to the binary and pass it with --config. Hunt both locations and the file’s creation time:

// Microsoft Defender XDR (KQL) - rclone configuration files and MEGAcmd tooling
// tune/validate: compare against your approved-backup inventory
DeviceFileEvents
| where Timestamp > ago(7d)
| where FileName =~ "rclone.conf"
    or FileName startswith "mega-" and FileName endswith ".bat"
    or FileName =~ "MEGAcmdServer.exe"
| project Timestamp, DeviceName, ActionType, FolderPath, FileName,
          InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName
| order by Timestamp desc

A config file that appears on a file server or domain controller minutes before large reads is a strong ordering signal.
Rclone defaults to many parallel transfers. Look for tens of concurrent sessions to one provider from a single process.
Run the tool name through your software inventory. If no team owns rclone, any execution is worth review.
Check for credential material: rclone obscures, but does not strongly encrypt, passwords in the config, so treat any copy of it as a credential leak.

Vetted sources

SigmaHQ publishes rclone execution and rclone.conf rules, Elastic ships a cloud-sync tool detection, and CISA ransomware advisories regularly cite rclone and MEGAcmd. Baseline your own environment — some IT teams run rclone for legitimate backups, which is why an owned allowlist matters.

Build Detections That Fire

Mjolnir Security helps blue teams turn threat intelligence into high-fidelity detections across endpoint, network, identity and cloud telemetry.

Detection EngineeringManaged Detection & ResponseThreat HuntingIncident ResponsePurple Teaming

Detection Engineering We build and tune detections mapped to ATT&CK from your own telemetry.
Threat Hunting as a Service Hypothesis-driven hunts for the behaviours on this page.
24/7 Incident Response Containment when a detection fires. Call +1 833 403 5875.

Written by: Mjolnir Threat Research (MTAC)  |  Published: October 12, 2026  |  Last reviewed: October 12, 2026

Signals at a Glance

Process and Command Line

Config and Network Artifacts

Build Detections That Fire

Data Exfiltration Detection

Detection Hub

Cloud Storage Exfil Detection

Data Staging and Archive Detection