Staged and Gone: Rclone Bulk Upload to MEGA From a File Server
A pre-ransomware bulk data-exfiltration investigation. After a perimeter foothold and hands-on command and control, the operator pivoted to a Windows file share server, recovered a domain-administrator password from a plaintext file, staged finance data into a single archive, and bulk-uploaded it to a MEGA cloud remote with a renamed rclone client over HTTPS before any encryptor ran. The organization also runs rclone legitimately on its backup server, so the challenge is separating the sanctioned job from the theft. Reconstruct the staging-then-upload chain from SIEM and perimeter firewall telemetry.
Start this operation
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
Incident brief
0Orient yourself before pivoting into the data. This is a no-answer briefing checkpoint.
Recover the abused administrator credential
35The operator did not crack a password; they found one lying in the open. Identify the privileged account whose credential was harvested and reused.
Find where the data was staged
30Before anything left the network, it was gathered into one place. Identify the single archive the operator built for exfiltration.
Separate the malicious upload tool from the sanctioned one
30rclone runs in this environment for a legitimate reason. Identify the binary the operator actually used to exfiltrate.
Pin the exfiltration destination
35Identify exactly where the staged archive was sent. Provide the cloud storage host that received the bulk upload.
Classify the exfiltration technique
30Name what the operator did when they pushed the archive off-site. Identify the MITRE ATT&CK sub-technique.
Recover the exfiltration tool indicator
35Pin down a huntable file indicator for the upload tool so it can be swept estate-wide. Provide the SHA-256 of the renamed rclone client.
7 tasks · 195 points total
Training Tools
Skills You'll Build
Requires foundational alert triage skills. Multiple data sources to correlate.
Prerequisites
- Basic understanding of security alerts
- Familiarity with SIEM concepts
- Familiarity with Firewall concepts
Ready to investigate?
More Operations
View allLingering in the Background: BITS Job Used for Download and Persistence
A teller workstation was cleaned by antivirus, yet the operator's foothold survived. The malware had abused the Background Intelligent Transfer Service: a self-contained BITS job with a SetNotifyCmdLine notification command re-downloads a payload and re-launches it with regsvr32 every time a transfer completes, then deletes its tracks, leaving only the job entry inside the service state database. Reconstruct the persistence loop from BITS-Client operational events, Sysmon process lineage, and endpoint XDR telemetry, prove it outlived the file-based cleanup, and classify the key ATT&CK techniques.
Trigona Ransomware: Rclone-to-MEGA Cloud Exfiltration
A fast, RDP-only, hands-on-keyboard intrusion that went from a valid Administrator logon on an exposed RDP gateway to estate-wide Trigona ransomware in under three hours. The actor dropped a batch-script and Netscan toolkit, enumerated the network and file shares, pivoted over RDP, disabled Windows Defender by hand, exfiltrated file shares to MEGA cloud storage with a renamed rclone client, then staged and ran the Trigona encryptor over SMB. Reconstruct the full kill chain from SIEM, endpoint XDR, and perimeter firewall telemetry, and classify the key ATT&CK techniques.
GoldDigger: Accessibility-Abusing Banker Draining APAC Accounts
A mobile-first banking-trojan intrusion on a corporate bring-your-own-device fleet. An employee searching for a government portal sideloaded a trojanized Android installer carrying the GoldDigger banker, granted it Accessibility Service, and the trojan then keylogged, painted fake bank-login overlays, intercepted SMS one-time-passcodes, and beaconed stolen data to a cluster of attacker command-and-control domains, enabling account-draining fraud. Reconstruct the kill chain from the mobile egress SIEM, the mobile threat-defense sensor, and the perimeter firewall, and classify the key ATT&CK mobile techniques.