Sigma rule: Copy From Or To Admin Share Or Sysvol Folder

Rule

Title

Copy From Or To Admin Share Or Sysvol Folder

Status

test

Level

medium

Author

Florian Roth (Nextron Systems), oscd.community, Teymur Kheirkhabarov @HeirhabarovT, Zach Stanford @svch0st, Nasreddine Bencherchali

Date

2019-12-30

Modified

2025-10-22

File

rules/windows/process_creation/proc_creation_win_susp_copy_lateral_movement.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects a copy command or a copy utility execution to or from an Admin share or remote

Log source

product

windows

category

process_creation

Detection

selection_target:
    CommandLine|contains:
        - '\\\\*\\*$' # example \\SVR_NAME\ADMIN$
        - '\Sysvol\'
selection_other_tools:
    - Image|endswith:
          - '\robocopy.exe'
          - '\xcopy.exe'
    - OriginalFileName:
          - 'robocopy.exe'
          - 'XCOPY.EXE'
selection_cmd_img:
    - Image|endswith: '\cmd.exe'
    - OriginalFileName: 'Cmd.Exe'
selection_cmd_cli:
    CommandLine|contains: 'copy'
selection_pwsh_img:
    - Image|contains:
          - '\powershell_ise.exe'
          - '\powershell.exe'
          - '\pwsh.exe'
    - OriginalFileName:
          - 'powershell_ise.exe'
          - 'PowerShell.EXE'
          - 'pwsh.dll'
selection_pwsh_cli:
    CommandLine|contains:
        - 'copy-item'
        - 'copy '
        - 'cpi '
        - ' cp '
        - 'move '
        - ' move-item'
        - ' mi '
        - ' mv '
condition: selection_target and (selection_other_tools or all of selection_cmd_* or all of selection_pwsh_*)

False positives (as the rule lists them)

• Administrative scripts

Tags

• attack.lateral-movement
• attack.collection
• attack.exfiltration
• attack.t1039
• attack.t1048
• attack.t1021.002

MITRE ATT&CK ids this rule names

• T1021.002
• T1039
• T1048

References

• https://twitter.com/SBousseaden/status/1211636381086339073
• https://drive.google.com/file/d/1lKya3_mLnR3UQuCoiYruO3qgu052_iS_/view
• https://www.elastic.co/guide/en/security/current/remote-file-copy-to-a-hidden-share.html
• https://www.microsoft.com/en-us/security/blog/2022/10/18/defenders-beware-a-case-for-post-ransomware-investigations/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_susp_copy_lateral_movement.yml