Copy From Or To Admin Share Or Sysvol Folder

SigmaHQ Detections@sigmaHQ

•updated Nov 10, 2025•0•0•0

Detects a copy command or a copy utility execution to or from an Admin share or remote