Elastic medium stable eql

Remote File Copy to a Hidden Share

Identifies a remote file copy attempt to a hidden network share. This may indicate lateral movement or data staging activity.

View Source

Detection Logic

process where host.os.type == "windows" and event.type == "start" and user.id != "S-1-5-18" and
  process.name : ("cmd.exe", "powershell.exe") and
  process.command_line : "*\\\\*\\*$*" and process.command_line : ("* copy*", "* move*", "* cp *", "* mv *")

Field Validations

Loading…

Comments (0)

Loading comments...