Remote File Copy to a Hidden Share

 1[metadata]
 2creation_date = "2020/11/04"
 3integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
 4maturity = "production"
 5updated_date = "2024/10/31"
 6min_stack_version = "8.14.0"
 7min_stack_comments = "Breaking change at 8.14.0 for the Windows Integration."
 8
 9[rule]
10author = ["Elastic"]
11description = """
12Identifies a remote file copy attempt to a hidden network share. This may indicate lateral movement or data staging
13activity.
14"""
15from = "now-9m"
16index = [
17    "logs-endpoint.events.process-*",
18    "winlogbeat-*",
19    "logs-windows.forwarded*",
20    "logs-windows.sysmon_operational-*",
21    "endgame-*",
22    "logs-system.security*",
23    "logs-m365_defender.event-*",
24    "logs-sentinel_one_cloud_funnel.*",
25    "logs-crowdstrike.fdr*",
26]
27language = "eql"
28license = "Elastic License v2"
29name = "Remote File Copy to a Hidden Share"
30references = ["https://www.elastic.co/security-labs/hunting-for-lateral-movement-using-event-query-language"]
31risk_score = 47
32rule_id = "fa01341d-6662-426b-9d0c-6d81e33c8a9d"
33severity = "medium"
34tags = [
35    "Domain: Endpoint",
36    "OS: Windows",
37    "Use Case: Threat Detection",
38    "Tactic: Lateral Movement",
39    "Data Source: Elastic Endgame",
40    "Data Source: Elastic Defend",
41    "Data Source: System",
42    "Data Source: Microsoft Defender for Endpoint",
43    "Data Source: Sysmon",
44    "Data Source: SentinelOne",
45    "Data Source: Crowdstrike",
46]
47timestamp_override = "event.ingested"
48type = "eql"
49
50query = '''
51process where host.os.type == "windows" and event.type == "start" and
52  (
53    process.name : ("cmd.exe", "powershell.exe", "xcopy.exe") and
54    process.args : ("copy*", "move*", "cp", "mv") or
55    process.name : "robocopy.exe"
56  ) and process.args : "*\\\\*\\*$*"
57'''
58
59
60[[rule.threat]]
61framework = "MITRE ATT&CK"
62[[rule.threat.technique]]
63id = "T1021"
64name = "Remote Services"
65reference = "https://attack.mitre.org/techniques/T1021/"
66[[rule.threat.technique.subtechnique]]
67id = "T1021.002"
68name = "SMB/Windows Admin Shares"
69reference = "https://attack.mitre.org/techniques/T1021/002/"
70
71
72
73[rule.threat.tactic]
74id = "TA0008"
75name = "Lateral Movement"
76reference = "https://attack.mitre.org/tactics/TA0008/"