Ransom Busters/UNC6671 Data Exfiltration via s5cmd to AWS S3

Ibrahim Saud@tektrix

•updated 21 days ago•0•0•1

Detects the execution of s5cmd.exe with command line arguments indicative of data transfer operations (sync, cp, mv, run) to or from an 's3://' URI. s5cmd is a high-performance command-line tool frequently used for parallel S3 operations, which may be leveraged by adversaries for rapid data exfiltration or staging.