Query: write Sigma for Detects a copy command or a copy utility execution to or from an Admin share or remote
Matching passage: Sigma rule: Detects a copy command or a copy utility execution to or from an Admin share or remote. Logsource: windows / process_creation. Rule: title: Copy From Or To Admin Share Or Sysvol Folder id: 855bc8b5-2ae8-402e-a9ed-b889e6df1900 status: test description: Detects a copy command or a copy utility execution to or from an Admin share or remote references: - https://twitter.com/SBousseaden/status/1211636381086339073 - https://drive.google.com/file/d/1lKya3_mLnR3UQuCoiYruO3qgu052_iS_/view - https://www.elastic.co/guide/en/security/current/remote-file-copy-to-a-hidden-share.html - https://www.microsoft.com/en-us/security/blog/2022/10/18/defenders-beware-a-case-for-post-ransomware-investigations/ author: Florian Roth (Nextron Systems), oscd.community, Teymur Kheirkhabarov @HeirhabarovT, Zach Stanford @svch0st, Nasreddine Bencherchali date: 2019-12-30 modified: 2025-10-22 tags: - attack.lateral-movement - attack.collection - attack.exfiltration - attack.t1039 - attack.t1048 - attack.t1021.002 logsource: category: process_creation product: windows detection: selection_target: CommandLine|contains: - \\\\*\\*$ - \Sysvol\ selection_other_tools: - Image|endswith: - \robocopy.exe - \xcopy.exe - OriginalFileName: - robocopy.exe - XCOPY.EXE selection_cmd_img: - Image|endswith: \cmd.exe - OriginalFileName: Cmd.Exe selection_cmd_cli: CommandLine|contains: copy selection_pwsh_img: - Image|contains: - \powershell_ise.exe - \powershell.exe - \pwsh.exe - OriginalFileName: - powershell_ise.exe - PowerShell.EXE - pwsh.dll selection_pwsh_cli: CommandLine|contains: - copy-item - 'copy ' - 'cpi ' - ' cp ' - 'move ' - ' move-item' - ' mi ' - ' mv ' condition: selection_target and (selection_other_tools or all of selection_cmd_* or all of selection_pwsh_*) falsepositives: - Administrative scripts level: medium
Near-miss passage: Sigma rule: Detects the execution of SharpWSUS or WSUSpendu, utilities that allow for lateral movement through WSUS. Windows Server. Logsource: windows / process_creation. Rule: title: HackTool - SharpWSUS/WSUSpendu Execution id: b0ce780f-10bd-496d-9067-066d23dc3aa5 status: test description: 'Detects the execution of SharpWSUS or WSUSpendu, utilities that allow for lateral movement through WSUS. Windows Server Update Services (WSUS) is a critical component of Windows systems and is frequently configured in a way that allows an attacker to circumvent internal networking limitations. ' references: - https://labs.nettitude.com/blog/introducing-sharpwsus/ - https://github.com/nettitude/SharpWSUS - https://web.archive.org/web/20210512154016/https://github.com/AlsidOfficial/WSUSpendu/blob/master/WSUSpendu.ps1 author: '@Kostastsale, Nasreddine Bencherchali (Nextron Systems)' date: 2022-10-07 modified: 2024-08-23 tags: - attack.execution - attack.lateral-movement - attack.t1210 logsource: product: windows category: process_creation detection: selection_wsuspendu_inject: CommandLine|contains: ' -Inject ' selection_wsuspendu_payload: CommandLine|contains: - ' -PayloadArgs ' - ' -PayloadFile ' selection_sharpwsus_commands: CommandLine|contains: - ' approve ' - ' create ' - ' check ' - ' delete ' selection_sharpwsus_flags: CommandLine|contains: - ' /payload:' - ' /payload=' - ' /updateid:' - ' /updateid=' condition: all of selection_wsuspendu_* or all of selection_sharpwsus_* falsepositives: - Unknown level: high