frack113
020fc8061f
chore: Upgrade status level from `experimental` to `test` for rules that have not changed in 300 days --------- Signed-off-by: frack113 <62423083+frack113@users.noreply.github.com> Co-authored-by: nasbench <8741929+nasbench@users.noreply.github.com>
24 lines
753 B
YAML
24 lines
753 B
YAML
title: Rclone Activity via Proxy
|
|
id: 2c03648b-e081-41a5-b9fb-7d854a915091
|
|
status: test
|
|
description: Detects the use of rclone, a command-line program to manage files on cloud storage, via its default user-agent string
|
|
references:
|
|
- https://rclone.org/
|
|
- https://www.kroll.com/en/insights/publications/cyber/new-m365-business-email-compromise-attacks-with-rclone
|
|
author: Janantha Marasinghe
|
|
date: 2022/10/18
|
|
tags:
|
|
- attack.exfiltration
|
|
- attack.t1567.002
|
|
logsource:
|
|
category: proxy
|
|
detection:
|
|
selection:
|
|
c-useragent|startswith: 'rclone/v'
|
|
condition: selection
|
|
fields:
|
|
- c-ip
|
|
falsepositives:
|
|
- Valid requests with this exact user agent to that is used by legitimate scripts or sysadmin operations
|
|
level: medium
|