Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Hunters International – RClone/WinSCP Bulk Transfer to External Endpoint

Hunters Exfiltration Sentinel
MITRE ATT&CK
Exfiltration Over Alternative Protocol
Data Source
DeviceProcessEvents
Date Added
2026-07-23
Last Updated
2026-07-23
Source
ransomware.live group_tools dataset (hunters)
What This Detects
Hunters International's data-theft-focused affiliates rely on RClone and WinSCP for bulk transfer following Advanced IP Scanner-driven discovery. Flags either tool invoked with copy/sync/sftp arguments.
Query
DeviceProcessEvents
| where Timestamp > ago(1d)
| where FileName in~ ("rclone.exe","winscp.exe","winscp.com")
| where ProcessCommandLine has_any ("copy","sync","/command","sftp://")
| project Timestamp, DeviceName, FileName, ProcessCommandLine, AccountName

Hunting queries are starting points for threat hunting & detection engineering — validate table/column names against your own workspace schema and tune thresholds before turning any of these into a production alert rule.