Remote File Copy

Title: Remote File Copy
Status: stable
Description:Detects the use of tools that copy files from or to remote systems
References:
  -https://www.cisa.gov/stopransomware/ransomware-guide
Author: Ömer Günal
Date: 2020-06-18
modified:None
Tags:

• -'attack.command-and-control'
• -'attack.lateral-movement'
• -'attack.t1105'

Logsource:

• product: linux

Detection:
  tools:
    - 'scp '
    - 'rsync '
    - 'sftp '
  filter:
    - '@'
    - ':'
  condition:tools and filter
Falsepositives:
  -Legitimate administration activities
Level: low