Query: detection rule: Detects a copy command or a copy utility execution to or from an Admin share or remote
Matching passage: Sigma rule: Detects a copy command or a copy utility execution to or from an Admin share or remote. Logsource: windows / process_creation. Rule: title: Copy From Or To Admin Share Or Sysvol Folder id: 855bc8b5-2ae8-402e-a9ed-b889e6df1900 status: test description: Detects a copy command or a copy utility execution to or from an Admin share or remote references: - https://twitter.com/SBousseaden/status/1211636381086339073 - https://drive.google.com/file/d/1lKya3_mLnR3UQuCoiYruO3qgu052_iS_/view - https://www.elastic.co/guide/en/security/current/remote-file-copy-to-a-hidden-share.html - https://www.microsoft.com/en-us/security/blog/2022/10/18/defenders-beware-a-case-for-post-ransomware-investigations/ author: Florian Roth (Nextron Systems), oscd.community, Teymur Kheirkhabarov @HeirhabarovT, Zach Stanford @svch0st, Nasreddine Bencherchali date: 2019-12-30 modified: 2025-10-22 tags: - attack.lateral-movement - attack.collection - attack.exfiltration - attack.t1039 - attack.t1048 - attack.t1021.002 logsource: category: process_creation product: windows detection: selection_target: CommandLine|contains: - \\\\*\\*$ - \Sysvol\ selection_other_tools: - Image|endswith: - \robocopy.exe - \xcopy.exe - OriginalFileName: - robocopy.exe - XCOPY.EXE selection_cmd_img: - Image|endswith: \cmd.exe - OriginalFileName: Cmd.Exe selection_cmd_cli: CommandLine|contains: copy selection_pwsh_img: - Image|contains: - \powershell_ise.exe - \powershell.exe - \pwsh.exe - OriginalFileName: - powershell_ise.exe - PowerShell.EXE - pwsh.dll selection_pwsh_cli: CommandLine|contains: - copy-item - 'copy ' - 'cpi ' - ' cp ' - 'move ' - ' move-item' - ' mi ' - ' mv ' condition: selection_target and (selection_other_tools or all of selection_cmd_* or all of selection_pwsh_*) falsepositives: - Administrative scripts level: medium
Near-miss passage: Sigma rule: Detects when an account makes changes to the ingress or egress rules of a security group. This can indicate that an atta. Logsource: aws / cloudtrail. Rule: title: Ingress/Egress Security Group Modification id: 6fb77778-040f-4015-9440-572aa9b6b580 status: test description: 'Detects when an account makes changes to the ingress or egress rules of a security group. This can indicate that an attacker is attempting to open up new attack vectors in the account, that they are trying to exfiltrate data over the network, or that they are trying to allow machines in that VPC/Subnet to contact a C&C server. ' references: - https://www.gorillastack.com/blog/real-time-events/important-aws-cloudtrail-security-events-tracking/ author: jamesc-grafana date: 2024-07-11 tags: - attack.initial-access - attack.t1190 logsource: product: aws service: cloudtrail detection: selection: eventSource: ec2.amazonaws.com eventName: - AuthorizeSecurityGroupEgress - AuthorizeSecurityGroupIngress - RevokeSecurityGroupEgress - RevokeSecurityGroupIngress condition: selection falsepositives: - New VPCs and Subnets being setup requiring a different security profile to those already defined - A single port being opened for a new service that is known to be deploying - Administrators closing unused ports to reduce the attack surface level: medium