Dedicated cloud-storage transfer utility invoked with an upload verb

Siemphony@siemphonymediumT1567.002unverified

AN1571's Windows leg would normally be matched at the dns_query source (`powershell.exe`/`excel.exe` resolving dropbox.com, drive.google.com, onedrive.live.com), but that is the exact shape of the rule already published for the parent T1567 in this corpus, whose domain list already contains those same three cloud-storage hosts alongside its file-sharing and paste-service terms. Repeating it here on the same logsource and field would be the same selection with a narrower list, not a distinct observable. This rule instead matches process creation for a small set of dedicated cloud-storage transfer binaries — rclone, azcopy and MEGAcmd — invoked with a subcommand that moves data outward, which is a different logsource (process_creation, not dns_query) and a different discriminator (the tool's own purpose, not a resolved name). The binary list ports AN1572's Linux `AllowedTools` knob (rclone, gsutil) to their Windows equivalents; gsutil and the AWS CLI are deliberately left out because on Windows both commonly resolve to a script wrapper rather than the named executable, which would make `Image` a dead selector. Neither the destination account nor the data volume is expressible in Sigma, so a hit is evidence a transfer tool ran with an upload-shaped verb, not evidence of what left or where it went. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0570, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where ((FolderPath endswith "\\rclone.exe" or FolderPath endswith "\\azcopy.exe" or FolderPath endswith "\\megacmd.exe" or FolderPath endswith "\\megasync.exe") and (ProcessCommandLine contains "copy" or ProcessCommandLine contains "sync" or ProcessCommandLine contains "copyto" or ProcessCommandLine contains "moveto" or ProcessCommandLine contains "put"))

Splunk · SPL

Run this as a search.

index=* ((Image="*\\rclone.exe" OR Image="*\\azcopy.exe" OR Image="*\\megacmd.exe" OR Image="*\\megasync.exe") AND (CommandLine="*copy*" OR CommandLine="*sync*" OR CommandLine="*copyto*" OR CommandLine="*moveto*" OR CommandLine="*put*"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((TO_LOWER(process.executable) LIKE "*\\\\rclone.exe" OR TO_LOWER(process.executable) LIKE "*\\\\azcopy.exe" OR TO_LOWER(process.executable) LIKE "*\\\\megacmd.exe" OR TO_LOWER(process.executable) LIKE "*\\\\megasync.exe") AND (TO_LOWER(process.command_line) LIKE "*copy*" OR TO_LOWER(process.command_line) LIKE "*sync*" OR TO_LOWER(process.command_line) LIKE "*copyto*" OR TO_LOWER(process.command_line) LIKE "*moveto*" OR TO_LOWER(process.command_line) LIKE "*put*"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)(\\rclone\.exe$|\\azcopy\.exe$|\\megacmd\.exe$|\\megasync\.exe$)</field>    <field name="CommandLine" type="pcre2">(?i)(copy|sync|copyto|moveto|put)</field>    <description>Dedicated cloud-storage transfer utility invoked with an upload verb</description>    <mitre>      <id>T1567.002</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: medium
Category: data_staging_exfil
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 6c6e72df-71a7-414e-b89a-489a57941ee8

ATT&CKT1567.002

T1567.002Exfiltration to Cloud Storage

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessondata staging exfil

data staging exfilAI draft — unreviewed

01 · What this rule detects

This rule fires when a Windows process named rclone.exe, azcopy.exe, megacmd.exe or megasync.exe runs with a command line containing an upload-shaped verb: copy, sync, copyto, moveto or put. It is not watching for cloud storage traffic in general — the parent T1567 rule in this corpus already covers powershell.exe/excel.exe resolving dropbox.com, drive.google.com and onedrive.live.com over DNS. This rule instead targets the tool's own purpose: dedicated transfer utilities invoked with a verb that moves data outward, on process_creation/windows, a different logsource and discriminator entirely.

02 · Telemetry you need

Sysmon EventID 1 (or Security 4688 with Audit Process Creation and Include command line in process creation events both enabled — neither is on by default). You need Image and CommandLine populated on every process start; without command-line auditing the selection_verb block never evaluates and the rule is silently blind, not quiet.

03 · How the logic works

Two selections, ANDed: selection_tool matches Image|endswith against the four binary names above, and selection_verb matches CommandLine|contains against the five verb strings. condition: selection_tool and selection_verb requires both. The binary list ports MITRE's AllowedTools knob from AN1572 (Linux rclone/gsutil) to Windows equivalents — the rule author's own substitution, not MITRE's; gsutil and the AWS CLI were deliberately dropped because on Windows they typically resolve to a script wrapper, which would leave Image dead (the trap AUTHORING.md calls out under binary-vs-interpreter mismatches). review.json caught a real instance of exactly that trap here: megacmd.exe is listed as a tool binary, but MEGAcmd's actual Windows install ships MEGAcmdServer.exe and MEGAcmdShell.exe — the individual commands are .bat wrappers around the server, not a binary called megacmd.exe. That OR-arm never fires; it looks like coverage and isn't. MEGAsync.exe is fine — it's a real GUI-client binary. Separately, copy and copyto are both in selection_verb; any string containing "copyto" already contains "copy", so copyto adds nothing and is dead weight rather than dead entirely. This rule also has no time window or volume aggregation — it fires on a single process launch. A hit is evidence a transfer tool ran with an upload-shaped verb, not evidence that data actually left, how much, or where it went. It catches the precursor action, not the exfiltration itself.

04 · Common false positives

The first false positive listed is framed explicitly as the highest-volume match: sanctioned IT backup automation using rclone/azcopy against an approved OneDrive or Azure Blob target. That single entry is why level sits at medium rather than high — a rule whose loudest expected match is routine and benign cannot honestly claim high severity. Beyond that: cloud-migration projects running these tools interactively for days, third-party backup products (Veeam, Duplicati) that shell out to rclone/azcopy internally, and personal MEGA sync as shadow IT.

05 · Detection maturity

tier_1: UNVERIFIED — lowest tier. This rule was authored from MITRE's brief and has never been executed against a single log line; the dead selector above is exactly the kind of defect that only surfaces once it does.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

MITRE's AllowedTools knob (AN1572) is the natural place to carve out the sanctioned scheduled-task account and destination remote rather than removing the tool. UserContext and WorkHours, MITRE knobs from the sibling analytics, would help scope by account or off-hours if the logsource carried them — this rule's fields don't, so that tuning has to happen downstream. Fixing the megacmd.exe dead selector (swap in MEGAcmdServer.exe/MEGAcmdShell.exe) and dropping redundant copyto are both free wins before deployment. Renaming any of these freely-renameable static binaries, or using a scripting SDK (boto3, PowerShell Az) instead of the named CLI, defeats Image|endswith entirely.

Declared by the author

Sanctioned backup and disaster-recovery automation. rclone and azcopy are the standard IT-blessed tools for scheduled pushes to an approved OneDrive, SharePoint or Azure Blob target, and in an environment that runs them for that purpose this is the highest-volume match — MITRE's AllowedTools knob is where the approved scheduled-task account and destination remote get carved out rather than dropping the tool from the list.
Cloud migration projects, where IT staff run rclone or azcopy interactively for a period of days or weeks to move a file share into a SaaS tenant, producing sustained matches from an admin workstation.
Third-party backup products (Veeam, Duplicati and similar) that bundle rclone or azcopy internally and shell out to it as their transfer engine, so the process and command line look identical to a manual run.
End users syncing personal MEGA storage with MEGAcmd or MEGAsync, which is common shadow-IT usage in development and creative teams that predates and is unrelated to any incident.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1567.002, evaluated against their process_creation events.

Share this rule

/u/siemphony/6c6e72df-71a7-414e-b89a-489a57941ee8

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Dedicated cloud-storage transfer utility invoked with an upload verb

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it