detection.wiki

Detection rules › Sigma

Copy From Or To Admin Share Or Sysvol Folder

Status
test
Severity
medium
Log source
category process_creation, product windows
Author
Florian Roth (Nextron Systems), oscd.community, Teymur Kheirkhabarov @HeirhabarovT, Zach Stanford @svch0st, Nasreddine Bencherchali
Source
github.com/SigmaHQ/sigma

Detects a copy command or a copy utility execution to or from an Admin share or remote

Known false positives

  • Administrative scripts

MITRE ATT&CK coverage

TacticTechniques
Lateral Movement
Collection
Exfiltration

Telemetry coverage

ProviderRecord / event type
SysmonEvent ID 1: Process creation

Rule body

title: Copy From Or To Admin Share Or Sysvol Folder
id: 855bc8b5-2ae8-402e-a9ed-b889e6df1900
status: test
description: Detects a copy command or a copy utility execution to or from an Admin share or remote
references:
    - https://twitter.com/SBousseaden/status/1211636381086339073
    - https://drive.google.com/file/d/1lKya3_mLnR3UQuCoiYruO3qgu052_iS_/view
    - https://www.elastic.co/guide/en/security/current/remote-file-copy-to-a-hidden-share.html
    - https://www.microsoft.com/en-us/security/blog/2022/10/18/defenders-beware-a-case-for-post-ransomware-investigations/
author: Florian Roth (Nextron Systems), oscd.community, Teymur Kheirkhabarov @HeirhabarovT, Zach Stanford @svch0st, Nasreddine Bencherchali
date: 2019-12-30
modified: 2025-10-22
tags:
    - attack.lateral-movement
    - attack.collection
    - attack.exfiltration
    - attack.t1039
    - attack.t1048
    - attack.t1021.002
logsource:
    category: process_creation
    product: windows
detection:
    selection_target:
        CommandLine|contains:
            - '\\\\*\\*$' # example \\SVR_NAME\ADMIN$
            - '\Sysvol\'
    selection_other_tools:
        - Image|endswith:
              - '\robocopy.exe'
              - '\xcopy.exe'
        - OriginalFileName:
              - 'robocopy.exe'
              - 'XCOPY.EXE'
    selection_cmd_img:
        - Image|endswith: '\cmd.exe'
        - OriginalFileName: 'Cmd.Exe'
    selection_cmd_cli:
        CommandLine|contains: 'copy'
    selection_pwsh_img:
        - Image|contains:
              - '\powershell_ise.exe'
              - '\powershell.exe'
              - '\pwsh.exe'
        - OriginalFileName:
              - 'powershell_ise.exe'
              - 'PowerShell.EXE'
              - 'pwsh.dll'
    selection_pwsh_cli:
        CommandLine|contains:
            - 'copy-item'
            - 'copy '
            - 'cpi '
            - ' cp '
            - 'move '
            - ' move-item'
            - ' mi '
            - ' mv '
    condition: selection_target and (selection_other_tools or all of selection_cmd_* or all of selection_pwsh_*)
falsepositives:
    - Administrative scripts
level: medium

Stages and Predicates

Stage 0: condition

selection_target and (selection_other_tools or all of selection_cmd_* or all of selection_pwsh_*)

Stage 1: selection_target

selection_target:
    CommandLine|contains:
        - '\\\\*\\*$'
        - '\Sysvol\'

Stage 2: selection_other_tools

selection_other_tools:
    - Image|endswith:
          - '\robocopy.exe'
          - '\xcopy.exe'
    - OriginalFileName:
          - 'robocopy.exe'
          - 'XCOPY.EXE'

Stage 3: selection_cmd_img

selection_cmd_img:
    - Image|endswith: '\cmd.exe'
    - OriginalFileName: 'Cmd.Exe'

Stage 4: selection_cmd_cli

selection_cmd_cli:
    CommandLine|contains: 'copy'

Stage 5: selection_pwsh_img

selection_pwsh_img:
    - Image|contains:
          - '\powershell_ise.exe'
          - '\powershell.exe'
          - '\pwsh.exe'
    - OriginalFileName:
          - 'powershell_ise.exe'
          - 'PowerShell.EXE'
          - 'pwsh.dll'

Stage 6: selection_pwsh_cli

selection_pwsh_cli:
    CommandLine|contains:
        - 'copy-item'
        - 'copy '
        - 'cpi '
        - ' cp '
        - 'move '
        - ' move-item'
        - ' mi '
        - ' mv '

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
CommandLinematch
  • cp corpus 8 (sigma 6, elastic 1, chronicle 1)
  • mi corpus 3 (sigma 2, chronicle 1)
  • move-item
  • mv corpus 4 (sigma 2, elastic 1, chronicle 1)
  • \Sysvol\ corpus 4 (sigma 4)
  • \\\\*\\*$
  • copy corpus 5 (sigma 4, chronicle 1)
  • copy corpus 12 (sigma 11, chronicle 1)
  • copy-item corpus 6 (sigma 5, chronicle 1)
  • cpi corpus 5 (sigma 4, chronicle 1)
  • move corpus 3 (sigma 2, chronicle 1)
field:"CommandLine" kind:match
Imageends_with
  • \cmd.exe corpus 130 (sigma 130)
  • \robocopy.exe corpus 4 (sigma 4)
  • \xcopy.exe corpus 5 (sigma 5)
field:"Image" kind:ends_with
Imagematch
  • \powershell.exe
  • \powershell_ise.exe
  • \pwsh.exe
field:"Image" kind:match
OriginalFileNameeq
  • Cmd.Exe corpus 81 (sigma 43, elastic 21, splunk 17)
  • PowerShell.EXE corpus 138 (sigma 84, splunk 30, elastic 24)
  • XCOPY.EXE corpus 5 (sigma 4, elastic 1)
  • powershell_ise.exe corpus 51 (splunk 30, sigma 18, elastic 3)
  • pwsh.dll corpus 112 (sigma 79, splunk 30, elastic 3)
  • robocopy.exe corpus 4 (sigma 4)
field:"OriginalFileName" kind:eq