Threat-Actor-Tool

This detection identifies the malicious use of 'rclone', a legitimate file synchronization utility, for data exfiltration or cloud abuse by flagging `rclone.exe` execution when specific suspicious command-line arguments are used, such as those indicating synchronization to remote cloud storage providers like `mega:`, `ftp:`, or generic `remote:`, especially in conjunction with flags like `--transfers`, `--ignore-existing`, or `--auto-confirm`, which is a critical indicator of compromise abused by threat actors for stealthy data exfiltration.