Copy to/from Admin Share or SYSVOL Folder
Detects the execution of copy commands or utilities (robocopy, xcopy, cmd copy, PowerShell Copy-Item/Move-Item) targeting or originating from Windows administrative shares (like C$, ADMIN$) or the SYSVOL folder. This activity can indicate lateral movement or data staging by an adversary.
YARA-L
