Copy To or From Admin Share or Sysvol Folder

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•24

Detects the execution of copy commands or utilities (robocopy, xcopy, cmd copy, PowerShell Copy-Item/Move-Item) targeting or originating from Windows Admin shares (e.g., C$) or the Sysvol folder. This activity can indicate lateral movement, data collection, or exfiltration by an adversary.