T1567.002 Exfiltration to Cloud Storage via rclone, AWS CLI, AzCopy, curl/wget

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•2

Detects the use of legitimate command-line utilities such as rclone, AWS CLI, AzCopy, curl, and wget to upload data to cloud storage endpoints, which is a common technique used for data exfiltration.