
title: Copy from Admin Share
author: Florian Roth, oscd.community, Teymur Kheirkhabarov @HeirhabarovT, Zach Stanford
  @svch0st
date: 2019/12/30
description: Detects a suspicious copy command to or from an Admin share
detection:
  SELECTION_1:
    EventID: 1
  SELECTION_2:
    Image:
    - '*\robocopy.exe'
    - '*\xcopy.exe'
  SELECTION_3:
    Image: '*\cmd.exe'
  SELECTION_4:
    CommandLine: '*copy*'
  SELECTION_5:
    Image: '*\powershell*'
  SELECTION_6:
    CommandLine:
    - '*copy-item*'
    - '*copy*'
    - '*cpi *'
    - '* cp *'
  SELECTION_7:
    CommandLine: '*\\\\\*'
  SELECTION_8:
    CommandLine: '*$*'
  condition: (SELECTION_1 and ((SELECTION_2 or (SELECTION_3 and SELECTION_4)) or (SELECTION_5
    and SELECTION_6)) and (SELECTION_7 and SELECTION_8))
falsepositives:
- Administrative scripts
fields:
- CommandLine
- ParentCommandLine
id: 855bc8b5-2ae8-402e-a9ed-b889e6df1900
level: high
logsource:
  category: process_creation
  product: windows
modified: 2020/11/28
references:
- https://twitter.com/SBousseaden/status/1211636381086339073
- https://drive.google.com/file/d/1lKya3_mLnR3UQuCoiYruO3qgu052_iS_/view
status: experimental
tags:
- attack.lateral_movement
- attack.collection
- attack.exfiltration
- attack.t1039
- attack.t1105
- attack.t1048
- attack.t1021.002
ruletype: SIGMA
