Remote File Copy to a Hidden Share

 1[metadata]
 2creation_date = "2020/11/04"
 3integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel"]
 4maturity = "production"
 5updated_date = "2024/10/15"
 6min_stack_version = "8.14.0"
 7min_stack_comments = "Breaking change at 8.14.0 for the Windows Integration."
 8
 9[rule]
10author = ["Elastic"]
11description = """
12Identifies a remote file copy attempt to a hidden network share. This may indicate lateral movement or data staging
13activity.
14"""
15from = "now-9m"
16index = [
17    "logs-endpoint.events.process-*",
18    "winlogbeat-*",
19    "logs-windows.forwarded*",
20    "logs-windows.sysmon_operational-*",
21    "endgame-*",
22    "logs-system.security*",
23    "logs-m365_defender.event-*",
24    "logs-sentinel_one_cloud_funnel.*",
25]
26language = "eql"
27license = "Elastic License v2"
28name = "Remote File Copy to a Hidden Share"
29references = ["https://www.elastic.co/security-labs/hunting-for-lateral-movement-using-event-query-language"]
30risk_score = 47
31rule_id = "fa01341d-6662-426b-9d0c-6d81e33c8a9d"
32severity = "medium"
33tags = [
34    "Domain: Endpoint",
35    "OS: Windows",
36    "Use Case: Threat Detection",
37    "Tactic: Lateral Movement",
38    "Data Source: Elastic Endgame",
39    "Data Source: Elastic Defend",
40    "Data Source: System",
41    "Data Source: Microsoft Defender for Endpoint",
42    "Data Source: Sysmon",
43    "Data Source: SentinelOne",
44]
45timestamp_override = "event.ingested"
46type = "eql"
47
48query = '''
49process where host.os.type == "windows" and event.type == "start" and
50  (
51    process.name : ("cmd.exe", "powershell.exe", "xcopy.exe") and
52    process.args : ("copy*", "move*", "cp", "mv") or
53    process.name : "robocopy.exe"
54  ) and process.args : "*\\\\*\\*$*"
55'''
56
57
58[[rule.threat]]
59framework = "MITRE ATT&CK"
60[[rule.threat.technique]]
61id = "T1021"
62name = "Remote Services"
63reference = "https://attack.mitre.org/techniques/T1021/"
64[[rule.threat.technique.subtechnique]]
65id = "T1021.002"
66name = "SMB/Windows Admin Shares"
67reference = "https://attack.mitre.org/techniques/T1021/002/"
68
69
70
71[rule.threat.tactic]
72id = "TA0008"
73name = "Lateral Movement"
74reference = "https://attack.mitre.org/tactics/TA0008/"