{"id":"7a14080d-a048-4de8-ae58-604ce58a795b","title":"Remote File Copy","description":"Detects the use of tools that copy files from or to remote systems","author":"Ömer Günal","status":"stable","level":"low","date":"2020-06-18","modified":"","tags":["attack.command-and-control","attack.lateral-movement","attack.t1105"],"technique_ids":["T1105"],"logsource":{"product":"linux"},"falsepositives":["Legitimate administration activities"],"references":["https://www.cisa.gov/stopransomware/ransomware-guide"],"source_path":"rules/linux/builtin/lnx_file_copy.yml","source_sha256":"5e7382c57d359df1ba9389a00fd8cfdc26a432a93ccbfe632f81f2a08f82ba21","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/builtin/lnx_file_copy.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Remote File Copy\nid: 7a14080d-a048-4de8-ae58-604ce58a795b\nstatus: stable\ndescription: Detects the use of tools that copy files from or to remote systems\nreferences:\n    - https://www.cisa.gov/stopransomware/ransomware-guide\nauthor: Ömer Günal\ndate: 2020-06-18\ntags:\n    - attack.command-and-control\n    - attack.lateral-movement\n    - attack.t1105\nlogsource:\n    product: linux\ndetection:\n    tools:\n        - 'scp '\n        - 'rsync '\n        - 'sftp '\n    filter:\n        - '@'\n        - ':'\n    condition: tools and filter\nfalsepositives:\n    - Legitimate administration activities\nlevel: low\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1105","id":"T1105","name":"Ingress Tool Transfer","page":"techniques/enterprise/T1105/"}],"data_path":"data/detection-rules/7a14080d-a048-4de8-ae58-604ce58a795b.json","kind":"sigma"}