Wesco Data Theft Extortion: ExfilSquad Breach — Detection and Response Guide for Supply-Chain Defenders

---
title: Suspicious Archive Creation by Compression Utility in Staging Directories
id: 3f8c2a71-9b4d-4e6f-a1c2-7d5e9f0b1234
status: experimental
description: Detects command-line execution of compression utilities (7z, rar, makecab, tar) writing archives into common extortion staging locations. A hallmark of data-theft staging prior to exfiltration.
references:
  - https://attack.mitre.org/techniques/T1560/001/
  - https://www.bleepingcomputer.com/news/security/wesco-confirms-security-incident-after-exfilsquad-claims-data-theft/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.collection
  - attack.t1560.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_tool:
    Image|endswith:
      - '\7z.exe'
      - '\7za.exe'
      - '\rar.exe'
      - '\makecab.exe'
      - '\tar.exe'
  selection_cli:
    CommandLine|contains:
      - ' a '
      - ' -a'
      - ' -pin '
  selection_path:
    CommandLine|contains:
      - 'C:\ProgramData'
      - 'C:\Users\Public'
      - 'C:\Windows\Temp'
      - 'C:\Temp'
  condition: selection_tool and selection_cli and selection_path
falsepositives:
  - Software packaging and deployment tooling (SCCM/Intune) using ProgramData for working directories
  - Backup agents performing scheduled archive operations
level: high
---
title: Execution of Known Data Exfiltration Tooling
id: 8a1d4e62-5c3f-4b79-9d0a-2e6f1c8b4567
status: experimental
description: Detects execution or command-line usage of tools routinely abused by extortion groups (rclone, MEGAsync, FileZilla, WinSCP) for bulk data exfiltration to cloud storage. ExfilSquad-style operations rely heavily on this tooling.
references:
  - https://attack.mitre.org/techniques/T1567/002/
  - https://attack.mitre.org/techniques/T1048/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.exfiltration
  - attack.t1567.002
  - attack.t1048
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\rclone.exe'
      - '\MEGAsync.exe'
      - '\FileZilla.exe'
      - '\WinSCP.exe'
      - '\pscp.exe'
  selection_cli:
    CommandLine|contains:
      - 'rclone copy'
      - 'rclone move'
      - 'rclone sync'
      - '--transfers='
      - 'mega.nz'
  selection_legit_path:
    Image|startswith:
      - 'C:\Program Files\FileZilla'
      - 'C:\Program Files (x86)\FileZilla'
  condition: (selection_img or selection_cli) and not selection_legit_path
falsepositives:
  - Developers and admins legitimately using WinSCP/FileZilla — scope the exclusion paths to your actual deployment locations
  - Managed backup products embedding rclone (Veeam/Comet) — allowlist by known install path and service account
level: critical
---
title: Renamed Exfiltration Binary Executing from Non-Standard Path
id: c2e7f1a4-6d8b-4c50-8e3f-9a0b5d7e8901
status: experimental
description: Detects binaries masquerading as system or benign names executing rclone-style arguments, a common defense-evasion pattern where attackers rename rclone.exe to evade application allowlists and simple name-based detections.
references:
  - https://attack.mitre.org/techniques/T1036/
  - https://attack.mitre.org/techniques/T1567/002/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.defense_evasion
  - attack.t1036
  - attack.exfiltration
  - attack.t1567.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_args:
    CommandLine|contains:
      - '--config'
      - 'copyto'
      - '--bwlimit'
      - '--no-check-certificate'
      - ':remote:'
      - 'mega:'
      - 'b2:'
      - 's3:'
  filter_known:
    Image|contains:
      - '\rclone'
      - '\Veeam'
      - '\Comet'
  condition: selection_args and not filter_known
falsepositives:
  - Rare. Legitimate rclone usage is covered by the known-path filter; validate against your backup stack before deployment
level: high

// Hunt 1: Compression utilities staging archives into suspicious directories
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where FileName in~ ("7z.exe","7za.exe","rar.exe","makecab.exe","tar.exe")
| where ProcessCommandLine has_any ("C:\\ProgramData","C:\\Users\\Public","C:\\Windows\\Temp")
    or ProcessCommandLine has_any (" -p", "-pin")   // password-protected archives are a strong extortion indicator
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, SHA256
| order by TimeGenerated desc;

// Hunt 2: Exfiltration tooling — execution and network connections
let ExfilTools = dynamic(["rclone.exe","megasync.exe","filezilla.exe","winscp.exe","pscp.exe"]);
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where FileName in~ ExfilTools or ProcessCommandLine has_any ("rclone copy","rclone sync","rclone move","--transfers=")
| extend HuntType = "ProcessExecution"
| project TimeGenerated, HuntType, DeviceName, AccountName, FileName, ProcessCommandLine, FolderPath
| union (
    DeviceNetworkEvents
    | where TimeGenerated > ago(14d)
    | where InitiatingProcessFileName in~ ExfilTools
    | where RemoteIPType == "Public"
    | extend HuntType = "NetworkConnection"
    | project TimeGenerated, HuntType, DeviceName, InitiatingProcessAccountName=AccountName, InitiatingProcessFileName=FileName, InitiatingProcessCommandLine=ProcessCommandLine, RemoteUrl, RemoteIP, RemotePort
)
| order by TimeGenerated desc;

// Hunt 3: Outbound data volume anomaly — endpoints pushing unusual egress to rare destinations
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where RemoteIPType == "Public"
| where ActionType == "ConnectionSuccess"
| summarize TotalConnections = count(), UniqueDestinations = dcount(RemoteIP)
    by DeviceName, InitiatingProcessFileName, bin(TimeGenerated, 1h)
| where TotalConnections > 2000    // tune to your baseline; catch bulk-transfer sessions
| join kind=inner (
    DeviceProcessEvents
    | where TimeGenerated > ago(7d)
    | project DeviceName, FileName, AccountName, ProcessCommandLine, ProcessTime=TimeGenerated
    ) on DeviceName, $left.InitiatingProcessFileName == $right.FileName
| where abs(datetime_diff('minute', ProcessTime, TimeGenerated)) < 60
| project TimeGenerated, DeviceName, InitiatingProcessFileName, AccountName, ProcessCommandLine, TotalConnections, UniqueDestinations
| order by TotalConnections desc;

-- Extortion staging triage: recent archives in staging paths + exfil tool execution
LET archives = SELECT FullPath, Size, Mtime
FROM glob(globs=['C:/ProgramData/**/*.zip','C:/ProgramData/**/*.7z','C:/ProgramData/**/*.rar',
                 'C:/Users/Public/**/*.zip','C:/Users/Public/**/*.7z','C:/Users/Public/**/*.rar',
                 'C:/Windows/Temp/**/*.zip','C:/Windows/Temp/**/*.7z','C:/Windows/Temp/**/*.rar'])
WHERE Mtime > (now() - 1209600)   -- last 14 days (seconds)
  AND Size > 52428800             -- >50 MB: bulk staging, not temp junk

LET procs = SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Exe =~ '(?i)(7z|7za|rar|rclone|megasync|filezilla|winscp|pscp)\.exe$'
   OR CommandLine =~ '(?i)(rclone (copy|move|sync)|--transfers=|mega\.nz)'

SELECT 'archive' AS FindingType, FullPath AS Artifact, Size AS SizeBytes,
       Mtime AS Timestamp, '' AS ProcessDetail, '' AS User
FROM archives
UNION ALL
SELECT 'process' AS FindingType, Exe AS Artifact, 0 AS SizeBytes,
       CreateTime AS Timestamp, CommandLine AS ProcessDetail, Username AS User
FROM procs
ORDER BY Timestamp DESC

# Wesco/ExfilSquad-style extortion sweep — read-only triage
# Run as Administrator. Output: CSV evidence files under C:\IR-Sweep
$OutDir = "C:\IR-Sweep"
New-Item -ItemType Directory -Path $OutDir -Force | Out-Null

# 1. Flag staged archives (>50MB, last 14 days) in common staging directories
$stagingPaths = @("$env:ProgramData", "$env:PUBLIC", "$env:SystemRoot\Temp", "C:\Temp")
foreach ($p in $stagingPaths) {
    if (Test-Path $p) {
        Get-ChildItem -Path $p -Recurse -Include *.zip,*.7z,*.rar,*.cab -ErrorAction SilentlyContinue |
            Where-Object { $_.Length -gt 50MB -and $_.LastWriteTime -gt (Get-Date).AddDays(-14) } |
            Select-Object FullName, Length, LastWriteTime, CreationTime |
            Export-Csv "$OutDir\staged_archives_$($p -replace '[^a-zA-Z]','_').csv" -NoTypeInformation
    }
}

# 2. Hunt for known exfiltration/archiving binaries anywhere on the system drive
$toolNames = @("rclone.exe","megasync.exe","filezilla.exe","winscp.exe","pscp.exe","7z.exe","7za.exe","rar.exe")
Get-ChildItem -Path "C:\" -Recurse -ErrorAction SilentlyContinue -Include $toolNames |
    Where-Object { $_.FullName -notmatch 'Program Files( \(x86\))?\\FileZilla' } |  # tune allowlist to YOUR approved tools
    Select-Object FullName, Length, LastWriteTime |
    Export-Csv "$OutDir\exfil_tools_found.csv" -NoTypeInformation

# 3. Check for persistence mechanisms commonly left by extortion actors
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run",
                 "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" -ErrorAction SilentlyContinue |
    Out-File "$OutDir\autoruns_registry.txt"
Get-ScheduledTask | Where-Object { $_.TaskPath -notlike "\Microsoft*" } |
    Select-Object TaskName, TaskPath, State |
    Export-Csv "$OutDir\non_microsoft_tasks.csv" -NoTypeInformation

# 4. Verify egress posture: confirm outbound rules exist to restrict server egress
$egressRules = Get-NetFirewallRule -Direction Outbound -Action Block -ErrorAction SilentlyContinue
if (-not $egressRules) {
    "WARNING: No outbound BLOCK firewall rules found. Servers should not have unrestricted egress." |
        Out-File "$OutDir\EGRESS_GAPS.txt"
}

# 5. Inventory SMB shares with Everyone/Anonymous access — prime extortion collection targets
Get-SmbShare | ForEach-Object {
    $access = Get-SmbShareAccess -Name $_.Name
    if ($access | Where-Object { $_.AccountName -match 'Everyone|Anonymous' -and $_.AccessRight -ne 'Deny' }) {
        [PSCustomObject]@{ Share = $_.Name; Path = $_.Path; Access = ($access.AccountName -join ';') }
    }
} | Export-Csv "$OutDir\overexposed_shares.csv" -NoTypeInformation

Write-Host "Sweep complete. Review $OutDir — triage any hits BEFORE remediation actions (preserve evidence)."