Query: Sigma rule for Detects a copy command or a copy utility execution to or from an Admin share or remote
Matching passage: Sigma rule: Detects a copy command or a copy utility execution to or from an Admin share or remote. Logsource: windows / process_creation. Rule: title: Copy From Or To Admin Share Or Sysvol Folder id: 855bc8b5-2ae8-402e-a9ed-b889e6df1900 status: test description: Detects a copy command or a copy utility execution to or from an Admin share or remote references: - https://twitter.com/SBousseaden/status/1211636381086339073 - https://drive.google.com/file/d/1lKya3_mLnR3UQuCoiYruO3qgu052_iS_/view - https://www.elastic.co/guide/en/security/current/remote-file-copy-to-a-hidden-share.html - https://www.microsoft.com/en-us/security/blog/2022/10/18/defenders-beware-a-case-for-post-ransomware-investigations/ author: Florian Roth (Nextron Systems), oscd.community, Teymur Kheirkhabarov @HeirhabarovT, Zach Stanford @svch0st, Nasreddine Bencherchali date: 2019-12-30 modified: 2025-10-22 tags: - attack.lateral-movement - attack.collection - attack.exfiltration - attack.t1039 - attack.t1048 - attack.t1021.002 logsource: category: process_creation product: windows detection: selection_target: CommandLine|contains: - \\\\*\\*$ - \Sysvol\ selection_other_tools: - Image|endswith: - \robocopy.exe - \xcopy.exe - OriginalFileName: - robocopy.exe - XCOPY.EXE selection_cmd_img: - Image|endswith: \cmd.exe - OriginalFileName: Cmd.Exe selection_cmd_cli: CommandLine|contains: copy selection_pwsh_img: - Image|contains: - \powershell_ise.exe - \powershell.exe - \pwsh.exe - OriginalFileName: - powershell_ise.exe - PowerShell.EXE - pwsh.dll selection_pwsh_cli: CommandLine|contains: - copy-item - 'copy ' - 'cpi ' - ' cp ' - 'move ' - ' move-item' - ' mi ' - ' mv ' condition: selection_target and (selection_other_tools or all of selection_cmd_* or all of selection_pwsh_*) falsepositives: - Administrative scripts level: medium
Near-miss passage: Sigma rule: Detects suspicious ways to download files from Microsoft domains that are used to store attachments in Emails or OneNote. Logsource: windows / process_creation. Rule: title: Suspicious Download from Office Domain id: 00d49ed5-4491-4271-a8db-650a4ef6f8c1 status: test description: Detects suspicious ways to download files from Microsoft domains that are used to store attachments in Emails or OneNote documents references: - https://twitter.com/an0n_r0/status/1474698356635193346?s=12 - https://twitter.com/mrd0x/status/1475085452784844803?s=12 author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2021-12-27 modified: 2022-08-02 tags: - attack.command-and-control - attack.resource-development - attack.t1105 - attack.t1608 logsource: product: windows category: process_creation detection: selection_download: - Image|endswith: - \curl.exe - \wget.exe - CommandLine|contains: - Invoke-WebRequest - 'iwr ' - 'curl ' - 'wget ' - Start-BitsTransfer - .DownloadFile( - .DownloadString( selection_domains: CommandLine|contains: - https://attachment.outlook.live.net/owa/ - https://onenoteonlinesync.onenote.com/onenoteonlinesync/ condition: all of selection_* falsepositives: - Scripts or tools that download attachments from these domains (OneNote, Outlook 365) level: high