Detecting Rclone and File-Sync Exfiltration Tooling: Endpoint, Network and Identity Signals That Catch Bulk Data Theft

Ransomware crews rarely write their own exfiltration code: they download Rclone, MEGAsync or restic, point it at attacker-owned storage and copy your file shares out in hours. These are legitimate, signed or well-known open-source tools, so a signature-only antivirus approach misses them and a blanket domain block misses the next storage provider. This guide explains how file-sync exfiltration looks on a Windows or Linux host and on the wire, gives detection logic you can build in an EDR, SIEM or Sigma pipeline, and covers the prevention controls that make the detections cheaper to run. It is written for detection engineers, SOC analysts and incident responders who need concrete artefacts, not general advice on data loss.

This is an independent guide from NHI Mgmt Group, based on Rclone's public documentation, MITRE ATT&CK and government advisories as of November 2026. It is not sponsored or reviewed by any tool maintainer or vendor named here, and it covers detection only.

Key takeaways

• Rclone is an exfiltration staple. MITRE ATT&CK tracks it as software S1040 and links it to Akira, Medusa Group, Scattered Spider, Storm-0501, INC Ransom, Ember Bear and the Conti-era campaigns, mostly under T1567.002 Exfiltration to Cloud Storage.
• Renaming is the norm, not the exception. Detect on PE metadata (description "Rsync for cloud storage", product "Rclone") and on command-line grammar, not only on the file name rclone.exe.
• The config file is the best single artefact. rclone.conf holds the attacker's remote type, endpoint and credentials, so its creation, location and contents tell you where the data went.
• Network signals complement the host. The default user agent starts with rclone/v, MEGA storage hosts such as userstorage.mega.co.nz are rarely queried by non-browser processes, and sustained outbound volume from a file server is unusual.
• Prevention makes detection quieter. Application control that blocks unapproved sync tools, egress filtering on servers and an inventory of the few approved Rclone jobs reduce alerts to the ones worth waking someone for.

Why file-sync tools are the exfiltration tool of choice

Double extortion depends on getting a large volume of data out quickly and reliably. Rclone is a single portable binary for Windows, Linux and macOS that syncs files with dozens of storage back ends, including Amazon S3, Google Drive, Dropbox, MEGA, FTP, SFTP and WebDAV, and parallelises uploads. The ATT&CK entry for Rclone records it compressing files before upload (T1560.001 Archive via Utility), splitting large files into chunks to stay under transfer limits (T1030 Data Transfer Size Limits), and exfiltrating over SFTP and HTTPS (T1048.002) or over FTP and plain HTTP (T1048.003), as well as to cloud storage.

Government advisories show the pattern in current operations. The joint #StopRansomware advisory on Medusa (AA25-071A, March 2025) states that Medusa actors install and use Rclone to move data to their own servers. The joint advisory on Scattered Spider (AA23-320A, November 2023) reports exfiltration to sites including MEGA[.]NZ. Rclone is not the only option: Red Canary research republished by Zscaler documents renamed MEGAsync binaries in intrusions linked to Sodinokibi, Pysa and Conti, and SigmaHQ carries a rule for restic, the open-source backup tool, after it was seen in a Nitrogen to BlackCat intrusion. The DFIR Report's June 2026 analysis of a Bumblebee to Akira intrusion found FileZilla over SFTP as the main exfiltration path, so treat Rclone as the most common member of a family rather than the only one.

See the MITRE ATT&CK T1567.002 Exfiltration Over Web Service and the Data Exfiltration Guide for the wider technique view.

What Rclone leaves on a host

Rclone is discoverable because it has to be configured somewhere. According to the Rclone documentation, the default config file is %APPDATA%/rclone/rclone.conf on Windows and ~/.config/rclone/rclone.conf elsewhere, but Rclone first checks for rclone.conf in the directory that holds the executable, which is exactly where an operator who dropped a portable binary into C:\ProgramData or C:\Users\Public will put it. The --config flag points at any other path. Rclone can also be configured entirely through environment variables: every option maps to RCLONE_ plus the upper-cased flag name, and a remote can be defined with variables such as RCLONE_CONFIG_MYS3_TYPE=s3, which leaves no config file at all.

Rclone stores config passwords obscured, not encrypted, so during response the file identifies the attacker's storage account for a takedown request. Preserve it before anyone cleans the host.

Endpoint detection logic

Build detections in layers so that a renamed binary with a config file still trips at least two of them. The rules below are expressed as logic rather than vendor query syntax; each maps to a published SigmaHQ rule you can convert for your SIEM. See the Sigma Rules Guide and the Sysmon Guide for the pipeline and telemetry.

Two refinements cut noise sharply: correlate on the account (a newly created or newly privileged account running a sync tool matters more than the nightly backup account) and on host role (file servers, domain controllers and database hosts should almost never originate a bulk upload).

Network detection and egress signals

Host telemetry can be blinded on the server the attacker controls, so pair it with network evidence. Rclone's default HTTP user agent is rclone/ followed by the version (for example rclone/v1.76.0), which SigmaHQ's "Rclone Activity via Proxy" rule matches on proxy logs; operators can change it with --user-agent, so its absence proves nothing. Restrict the remaining checks to egress points you control:

• Storage domains from non-browser processes: alert when a process other than an approved browser resolves or connects to MEGA (mega.nz, mega.io, mega.co.nz, userstorage.mega.co.nz) or other consumer storage. Red Canary's guidance is to watch for non-browser processes, because a domain block is easy for an operator to route around.
• Volume and duration: sustained outbound transfer from a server segment, tens of gigabytes over hours, to a destination with no prior history. NetFlow or IPFIX and firewall session logs answer this without TLS inspection. See the NDR Guide.
• Protocol on the wrong host: SFTP, FTP or WebDAV sessions from file servers or domain controllers to the internet. The DFIR Report's 2026 Akira case measured about 77 GB leaving over two FileZilla SFTP sessions, which a simple per-host egress volume threshold would have flagged.
• Parallel upload shape: Rclone's --transfers and --multi-thread-streams produce many concurrent TLS sessions to the same storage endpoint from one process, a shape that differs from a user uploading through a browser.

Where identity fits

File-sync exfiltration is an identity problem in two directions. Outbound, rclone.conf is a credential store: if your own teams use Rclone for backups or migrations, the config holds cloud access keys, OAuth refresh tokens or service account keys for your storage, and a stolen config gives an attacker a ready-made path into your cloud. Store those configs encrypted (Rclone supports config encryption, with the password supplied through RCLONE_CONFIG_PASS or a password command), scope the keys to the one bucket the job needs, and rotate them like any other machine credential. See the Secrets Management Guide.

Inbound, the account that runs the copy matters. Exfiltration usually runs under a compromised domain administrator or a service account with broad read access to shares. Detections that know which accounts are approved to run sync tools, and which accounts normally read which shares, turn a generic "Rclone ran" alert into "an account that has never touched the finance share copied 40 GB of it to MEGA". See the Service Account Security Guide. The Storm-0501 Hybrid Cloud Attacks 2024 breach shows the same actor class pivoting through a synchronisation account into the cloud; ATT&CK also records Storm-0501 using Rclone for exfiltration.

Prevention controls that make detection cheaper

• Application control: block Rclone, MEGAsync, MEGAcmd and restic on servers and standard workstations by publisher, hash and product metadata, with a narrow exception for named backup hosts. See the App Control for Business (WDAC) guide.
• Server egress deny by default: file servers, domain controllers and database hosts should reach only the update, backup and monitoring destinations they need (NIST SP 800-53 SC-7(5) Deny by Default, Allow by Exception). See the Cloud Egress Filtering guide.
• Category blocking for consumer storage: block personal cloud storage categories at the proxy for server segments and, where policy allows, for users, while allowing the sanctioned corporate tenant.
• Inventory approved use: keep a list of hosts, accounts, remotes and schedules for any sanctioned Rclone or restic job. Every detection becomes a comparison against that list.

Implementation: a phased rollout

1. Inventory (week 1 to 2): search 90 days of process telemetry for Rclone, MEGAsync, restic and SFTP clients by metadata, not file name. Record each legitimate use with owner, host, account and destination.
2. Telemetry gaps (week 2 to 3): confirm process creation with full command line (Sysmon Event ID 1 or Security 4688 with command-line auditing), file creation (Event ID 11) and DNS (Event ID 22 or DNS Client 3008) on all servers, plus proxy or firewall logs with byte counts.
3. Deploy detections in alert-only mode (week 3 to 6): start with renamed Rclone and Rclone on server roles (high fidelity), then config creation and non-browser MEGA DNS. Tune exclusions against the inventory, not by suppressing whole rules.
4. Test (week 6): in a lab or approved test window, run Rclone renamed to a benign name with a config file next to it, copying dummy files to a test bucket you own. Confirm each rule fires, the alert reaches the queue and the analyst playbook resolves it. Repeat with environment variable configuration to test the no-config path.
5. Enforce prevention (week 6 to 10): move application control for sync tools from audit to enforce on servers first, then workstations, in pilot rings. Roll back by returning the policy to audit mode if a business process breaks, and add a named exception rather than a broad one.
6. Response playbook: on a confirmed hit, isolate the host, preserve rclone.conf, the binary, process tree and proxy logs, recover the destination and credentials from the config, and request takedown of the attacker storage through the provider's abuse process. See the Data Exfiltration Playbook.

Decision guidance

Measuring whether it works

• Coverage: percentage of servers sending process creation with command line, file creation and DNS telemetry (target 100% of tier 0 and file servers).
• Test pass rate: share of quarterly emulation runs (renamed binary, env-var config, MEGA, SFTP) that produced an alert within 15 minutes.
• Unapproved executions: count of sync tool executions outside the approved inventory per month, trending to zero as application control enforces.
• Time to contain: median time from first sync tool alert to host isolation in real or simulated incidents.

Framework mapping

Common failure patterns

• Matching on the file name only: operators rename Rclone (Red Canary cites sihosts.exe) and MEGAsync, so a rule on rclone.exe alone misses the real case.
• Blocking one domain and calling it done: blocking mega.nz while servers can still reach any SFTP host or S3-compatible endpoint just moves the destination.
• Excluding the backup server wholesale: broad exclusions for "the host that runs Rclone" give attackers the perfect place to run it. Exclude the exact job, account and remote.
• No server egress control: file servers and domain controllers with open internet access turn a detection into a race against the upload. The Change Healthcare Breach 2024 is a reminder that in modern ransomware the data theft comes before the encryption, so exfiltration is the last point at which a defender can limit the damage.
• Cleaning the host before preserving the config: rclone.conf is the map of where the data went; wiping it loses the attacker's account details.

Practitioner checklist

• Hunt 90 days of process telemetry for Rclone, MEGAsync, restic and SFTP clients by PE metadata and command line.
• Build an approved-use inventory of hosts, accounts, remotes and schedules.
• Enable process command line, file creation and DNS logging on every server.
• Deploy the renamed-Rclone, Rclone-config and non-browser MEGA DNS rules first.
• Add egress volume and duration alerts per host role using flow or firewall logs.
• Block sync tools with application control on servers, then workstations, in pilot rings.
• Restrict server egress to named destinations and block personal cloud storage categories.
• Emulate renamed and environment-variable Rclone runs every quarter and record the result.

Standards and references

• MITRE ATT&CK: Rclone (S1040)
• MITRE ATT&CK: Exfiltration to Cloud Storage (T1567.002)
• CISA, FBI and MS-ISAC: #StopRansomware: Medusa Ransomware (AA25-071A)
• FBI and CISA: Scattered Spider (AA23-320A)
• Rclone: Documentation (configuration file, environment variables and flags)
• SigmaHQ: Sigma detection rules repository
• Microsoft Learn: Sysmon
• Red Canary (Zscaler): Transferring leverage in a ransomware attack

Related NHI Mgmt Group resources: Data Exfiltration Guide · MITRE ATT&CK T1567.002 Exfiltration Over Web Service · Medusa Ransomware Threat Actor Profile · Detecting RustDesk, MeshCentral and Tactical RMM Abuse · Detecting Ligolo-ng, Chisel and frp Tunnelling Tools