detection.wiki

Detection rules › Sigma

Remote File Copy

Status
stable
Severity
low
Log source
product linux
Author
Ömer Günal
Source
github.com/SigmaHQ/sigma

Detects the use of tools that copy files from or to remote systems

Known false positives

  • Legitimate administration activities

MITRE ATT&CK coverage

TacticTechniques
Command & Control

Rule body

title: Remote File Copy
id: 7a14080d-a048-4de8-ae58-604ce58a795b
status: stable
description: Detects the use of tools that copy files from or to remote systems
references:
    - https://www.cisa.gov/stopransomware/ransomware-guide
author: Ömer Günal
date: 2020-06-18
tags:
    - attack.command-and-control
    - attack.lateral-movement
    - attack.t1105
logsource:
    product: linux
detection:
    tools:
        - 'scp '
        - 'rsync '
        - 'sftp '
    filter:
        - '@'
        - ':'
    condition: tools and filter
falsepositives:
    - Legitimate administration activities
level: low

Stages and Predicates

Stage 0: condition

tools and filter

Stage 1: tools

tools:
    - 'scp '
    - 'rsync '
    - 'sftp '

Stage 2: filter

filter:
    - '@'
    - ':'