Copy From Or To Admin Share Or Sysvol Folder (855bc8b5-2ae8-402e-a9ed-b889e6df1900)

Detects a copy command or a copy utility execution to or from an Admin share or remote

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
SMB/Windows Admin Shares - T1021.002 (4f9ca633-15c5-463c-9724-bdcd54fde541)	Attack Pattern	Copy From Or To Admin Share Or Sysvol Folder (855bc8b5-2ae8-402e-a9ed-b889e6df1900)	Sigma-Rules	1
Data from Network Shared Drive - T1039 (ae676644-d2d2-41b7-af7e-9bed1b55898c)	Attack Pattern	Copy From Or To Admin Share Or Sysvol Folder (855bc8b5-2ae8-402e-a9ed-b889e6df1900)	Sigma-Rules	1
Exfiltration Over Alternative Protocol - T1048 (a19e86f8-1c0a-4fea-8407-23b73d615776)	Attack Pattern	Copy From Or To Admin Share Or Sysvol Folder (855bc8b5-2ae8-402e-a9ed-b889e6df1900)	Sigma-Rules	1
SMB/Windows Admin Shares - T1021.002 (4f9ca633-15c5-463c-9724-bdcd54fde541)	Attack Pattern	Remote Services - T1021 (54a649ff-439a-41a4-9856-8d144a2551ba)	Attack Pattern	2