Exfiltration to Cloud Storage via rclone/AWS CLI/AzCopy - T1567.002

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•1

Detects HTTP traffic patterns consistent with data exfiltration to major cloud storage providers (AWS S3, Azure Blob Storage, Google Cloud Storage) using common command-line interface tools like rclone, aws-cli, and AzCopy.