Potential Russian APT Credential Theft via XCopy and ADExplorer
This rule detects command-line patterns associated with potential Russian APT credential theft activities, specifically targeting Active Directory data. It looks for the use of `xcopy` to copy the `sysvol` directory, which can contain sensitive information, and `adexplorer` to create a snapshot of Active Directory data, typically saved as a `.snp` file in a user's downloads directory. These actions are indicative of adversaries attempting to exfiltrate or analyze Active Directory credentials and configuration.
Sigma
