PUA - Rclone Execution

Hunt Hypothesis

Detects execution of RClone utility for exfiltration as used by various ransomwares strains like REvil, Conti, FiveHands, etc

Detection Rule

Sigma (Original)

title: PUA - Rclone Execution
id: e37db05d-d1f9-49c8-b464-cee1a4b11638
related:
    - id: a0d63692-a531-4912-ad39-4393325b2a9c
      type: obsolete
    - id: cb7286ba-f207-44ab-b9e6-760d82b84253
      type: obsolete
status: test
description: Detects execution of RClone utility for exfiltration as used by various ransomwares strains like REvil, Conti, FiveHands, etc
references:
    - https://research.nccgroup.com/2021/05/27/detecting-rclone-an-effective-tool-for-exfiltration/
    - https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware
    - https://us-cert.cisa.gov/ncas/analysis-reports/ar21-126a
    - https://labs.sentinelone.com/egregor-raas-continues-the-chaos-with-cobalt-strike-and-rclone
    - https://www.splunk.com/en_us/blog/security/darkside-ransomware-splunk-threat-update-and-detections.html
author: Bhabesh Raj, Sittikorn S, Aaron Greetham (@beardofbinary) - NCC Group
date: 2021-05-10
modified: 2023-03-05
tags:
    - attack.exfiltration
    - attack.t1567.002
logsource:
    product: windows
    category: process_creation
detection:
    selection_specific_options:
        CommandLine|contains|all:
            - '--config '
            - '--no-check-certificate '
            - ' copy '
    selection_rclone_img:
        - Image|endswith: '\rclone.exe'
        - Description: 'Rsync for cloud storage'
    selection_rclone_cli:
        CommandLine|contains:
            - 'pass'
            - 'user'
            - 'copy'
            - 'sync'
            - 'config'
            - 'lsd'
            - 'remote'
            - 'ls'
            - 'mega'
            - 'pcloud'
            - 'ftp'
            - 'ignore-existing'
            - 'auto-confirm'
            - 'transfers'
            - 'multi-thread-streams'
            - 'no-check-certificate '
    condition: selection_specific_options or all of selection_rclone_*
falsepositives:
    - Unknown
level: high

KQL (Azure Sentinel)

imProcessCreate
| where (TargetProcessCommandLine contains "--config " and TargetProcessCommandLine contains "--no-check-certificate " and TargetProcessCommandLine contains " copy ") or ((TargetProcessName endswith "\\rclone.exe" or TargetProcessFileDescription =~ "Rsync for cloud storage") and (TargetProcessCommandLine contains "pass" or TargetProcessCommandLine contains "user" or TargetProcessCommandLine contains "copy" or TargetProcessCommandLine contains "sync" or TargetProcessCommandLine contains "config" or TargetProcessCommandLine contains "lsd" or TargetProcessCommandLine contains "remote" or TargetProcessCommandLine contains "ls" or TargetProcessCommandLine contains "mega" or TargetProcessCommandLine contains "pcloud" or TargetProcessCommandLine contains "ftp" or TargetProcessCommandLine contains "ignore-existing" or TargetProcessCommandLine contains "auto-confirm" or TargetProcessCommandLine contains "transfers" or TargetProcessCommandLine contains "multi-thread-streams" or TargetProcessCommandLine contains "no-check-certificate "))

Required Data Sources

False Positive Guidance

• Unknown

MITRE ATT&CK Context

• Tactic: Exfiltration
• Technique: T1567.002 — T1567.002

References

• https://research.nccgroup.com/2021/05/27/detecting-rclone-an-effective-tool-for-exfiltration/
• https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware
• https://us-cert.cisa.gov/ncas/analysis-reports/ar21-126a
• https://labs.sentinelone.com/egregor-raas-continues-the-chaos-with-cobalt-strike-and-rclone
• https://www.splunk.com/en_us/blog/security/darkside-ransomware-splunk-threat-update-and-detections.html
• SigmaHQ Rule