Cloud storage exfiltration via rclone/MEGAsync-style sync tools

Ibrahim Saud@tektrix

•updated 12 days ago•0•0•1

Detects the initialization of cloud synchronization tools like rclone or MEGAsync, accompanied by the creation of configuration files and subsequent high-volume network activity directed toward common cloud storage providers, indicative of unauthorized data exfiltration.