WinSCP or Rclone outbound SSH/SFTP transfer from non-standard location

ills3c Intel&Coffee@Ills3C

•updated yesterday•1•0•1

Detects the execution of known portable utilities (WinSCP or Rclone) from user-writable directories (such as AppData, Temp, or Downloads) making outbound connections on port 22 and performing file transfer operations, suggesting potential data exfiltration.