RcloneConf
Rclone config file
- 25 paths
.rclone.confrclone.conf- Per-user data
- Version 1.2
- Eric Capuano, Reece394
Paths on disk
25 paths
Notes
Rclone is a popular exfil tool that supports many cloud storage services
For performance reasons it is recommended to comment out the recursive Rclone config rules with #s. On bigger disks with many files it could add hours on to the triage collection.
References
5 links
- research.nccgroup.com/2021/05/27/detecting-rclone-an-effective-tool-for-exfiltration/(opens in new tab)
- rclone.org/docs/(opens in new tab)
- github.com/rclone/rclone/issues/4667(opens in new tab)
- github.com/rclone/rclone/pull/5226(opens in new tab)
- xdg-net.github.io/Xdg.Directories/docs/defaults.html(opens in new tab)