Proving What Left the Building: Reconstructing Rclone Exfiltration from Memory Evidence

"What data was taken?" is one of the first questions legal counsel asks during a ransomware engagement, and in most cases, it's the hardest question to answer. Rclone has become the de facto exfiltration tool used by ransomware affiliates: it's free, flexible, and quiet. Analysts typically fall back on firewall logs for a byte count however, this doesn’t tell us what has been taken. This session demonstrates how to turn a memory image, which can be paired with a packet capture, into an inventory of exfiltrated files. It dissects what rclone leaves in memory, including execution artifacts, command line arguments, and the config file. These details include the deobfuscated remote location, which reveals the destination service, the account, and the master key. From the packet capture, the tool carves the encrypted uploaded blobs, collects the exact file sizes, and then correlates them with the memory artifacts, source directory listings, and file sizes. This session shows why capture timing affects what you can collect: account keys, file encryption keys, and transport keys. During this session, a free tool that automates this and formats the output for executives and legal counsel to help drive notification decisions as well as the limitations of this tool.