Windows Copy Files (Windows Event Log)

id: '5685.5946'
title: Windows Copy Files
description: 'Adversaries may search local system sources, such as file systems or
  local databases, or network shares to find files of interest and sensitive data
  prior to Exfiltration. Interactive command shells may be in use, and common functionality
  within cmd may be used to gather information. These events are only detected when
  a new process is created, or if powershell logging is enabled and used. Threat Actor
  Association: APT29, Evilnum, REvil, TA428, Vice Society Software Association: Black
  Basta, SamSam Atomics T1505.003 Test #1'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) (TERM(copy) OR TERM(xcopy) OR TERM(robocopy))
  | regex process="(?i)(((^|\s+)copy|(xcopy|robocopy)(\.exe)?\"?)\s+)" | table _time,
  host, user signature_id, process, process_*, parent_* | bin span=1s | stats values(*)
  as * by _time, host '
techniques:
- collection:data from local system
- execution:command and scripting interpreter
- collection:data from network shared drive
technique_id: 
- T1005
- T1059
- T1039
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://book.hacktricks.xyz/exfiltration
- https://www.computerhope.com/xcopyhlp.htm