Remote File Copy Tool Usage
Detects the use of command-line tools such as 'scp', 'rsync', and 'sftp' that are commonly used to copy files to or from remote systems. This activity can be indicative of an adversary transferring tools into an environment (Ingress Tool Transfer) or moving files laterally within a compromised network (Lateral Tool Transfer). The rule specifically looks for the presence of these tool names followed by a space and then a colon or an '@' symbol, which are characteristic of remote file operations.
Sigma
