🐾 - 🚨 Suspicious Rclone SSH connection to Internet 🌐 - Possible file exfiltration 🗃 - Suricata Rule 3300128 (pawpatrules)

🐾 - 🚨 Suspicious Rclone SSH connection to Internet 🌐 - Possible file exfiltration 🗃

SID: 3300128Rev: 50 views

Sourcepawpatrules

CreatedAugust 5, 2021

UpdatedJune 10, 2022

Classificationpolicy-violation

alert ssh any any -> $EXTERNAL_NET any (msg:"🐾 - 🚨 Suspicious Rclone SSH connection to Internet 🌐 - Possible file exfiltration 🗃"; flow:to_server, stateless; ssh.software; content:"rclone/"; nocase; reference:url,https://rclone.org/; metadata:created_at 2021_08_05, updated_at 2022_06_10; sid:3300128; rev:5; classtype:policy-violation;)

References

url	https://rclone.org/

Metadata

created at2021_08_05

updated at2022_06_10

Comments (0)

Please sign in to leave a comment.

No comments yet. Be the first to comment!