Remote File Copy — Sigma Rule

Rule metadata and linked tags

Author: Ömer Günal. Source status: stable; severity: low. Source dates: 2020-06-18 / not supplied.

{
  "product": "linux"
}

Pinned original Sigma rule · Detection Rule License 1.1

Source SHA-256: 5e7382c57d359df1ba9389a00fd8cfdc26a432a93ccbfe632f81f2a08f82ba21

Detection logic

Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.

title: Remote File Copy
id: 7a14080d-a048-4de8-ae58-604ce58a795b
status: stable
description: Detects the use of tools that copy files from or to remote systems
references:
    - https://www.cisa.gov/stopransomware/ransomware-guide
author: Ömer Günal
date: 2020-06-18
tags:
    - attack.command-and-control
    - attack.lateral-movement
    - attack.t1105
logsource:
    product: linux
detection:
    tools:
        - 'scp '
        - 'rsync '
        - 'sftp '
    filter:
        - '@'
        - ':'
    condition: tools and filter
falsepositives:
    - Legitimate administration activities
level: low

Original YAML and metadata in JSON

False positives

• Legitimate administration activities

Source references

• https://www.cisa.gov/stopransomware/ransomware-guide