PowerShell script block copies a file from a UNC path

Siemphony@siemphonylowT1074.002unverifiedPlaybook · Collection and exfiltration

Matches a 4104 script block that both names a copy verb (Copy-Item or robocopy) and contains a UNC path literal — the part of AN0194 that actually says "remote": T1074 and T1074.001, already published in this corpus, both match on a local write into a shared directory and cannot tell a file that originated on the same host from one pulled across the network. Requiring the UNC prefix in the same script block is the cheapest way to recover that distinction from a single event, at the cost of not knowing whether the UNC path is the source or the destination — Sigma cannot parse Copy-Item's argument order, so a push in the wrong direction matches identically to a remote pull. AN0194's other two log sources are deliberately not used here: the SMBClient/Security channel's EventID 31001 fields are not documented with enough confidence to author against per this corpus's own field-verification rule, and Sysmon EventID 11 (used by the sibling rules above) only records the file that was created, never where it came from, so it cannot carry the remote-origin signal at all. Script Block Logging is off in a default install and in the MS and CIS baselines; without it 4104 produces nothing, and an empty result means blind, not clean. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0071, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

1title: PowerShell script block copies a file from a UNC path2id: aa8adf1c-5a06-433a-93d2-2b1edad688753status: experimental4description: |5  Matches a 4104 script block that both names a copy verb (Copy-Item or6  robocopy) and contains a UNC path literal — the part of AN0194 that7  actually says "remote": T1074 and T1074.001, already published in this8  corpus, both match on a local write into a shared directory and cannot9  tell a file that originated on the same host from one pulled across the10  network. Requiring the UNC prefix in the same script block is the cheapest11  way to recover that distinction from a single event, at the cost of not12  knowing whether the UNC path is the source or the destination — Sigma13  cannot parse Copy-Item's argument order, so a push in the wrong direction14  matches identically to a remote pull. AN0194's other two log sources are15  deliberately not used here: the SMBClient/Security channel's EventID 3100116  fields are not documented with enough confidence to author against per this17  corpus's own field-verification rule, and Sysmon EventID 11 (used by the18  sibling rules above) only records the file that was created, never where it19  came from, so it cannot carry the remote-origin signal at all. Script Block20  Logging is off in a default install and in the MS and CIS baselines; without21  it 4104 produces nothing, and an empty result means blind, not clean.22  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0071, not hand-written and not tested by its author. Any lab result is on this rule's own page.23references:24  - https://attack.mitre.org/techniques/T1074/00225  - https://attack.mitre.org/detectionstrategies/DET007126author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)27date: 2026-08-1628tags:29  - attack.collection30  - attack.t1074.00231logsource:32  product: windows33  service: powershell34detection:35  selection_event:36    EventID: 410437  selection_verb:38    ScriptBlockText|contains:39      - 'Copy-Item'40      - 'copy-item'41      - 'Robocopy'42      - 'robocopy'43  selection_unc:44    ScriptBlockText|contains: '\\\\'45  condition: selection_event and selection_verb and selection_unc46falsepositives:47  - "Logon scripts and Group Policy or SCCM/Intune deployment scripts, which are the single most common source of a Copy-Item or robocopy call against a UNC path in any managed estate and run on a predictable schedule under a service or machine account."48  - "Folder-redirection and roaming-profile sync scripts that robocopy a user's Desktop or Documents to a UNC file-server path at logon or logoff — ordinary and expected on every session for estates that use roaming profiles."49  - "Backup and disaster-recovery jobs that Copy-Item a nightly export to a UNC path on a dedicated backup share, producing a burst of identical matches across the fleet at the same time every night."50  - "Build and release scripts that robocopy compiled artefacts to or from an internal UNC build share as part of a CI pipeline running PowerShell on a build agent."51level: low

Sentinel · KQL

Run this as a search.

Event| where ((EventID == 4104 and (ScriptBlockText contains "Copy-Item" or ScriptBlockText contains "copy-item" or ScriptBlockText contains "Robocopy" or ScriptBlockText contains "robocopy")) and ScriptBlockText contains "\\\\")

Splunk · SPL

Run this as a search.

index=* ((EventID="4104" AND (ScriptBlockText="*Copy-Item*" OR ScriptBlockText="*copy-item*" OR ScriptBlockText="*Robocopy*" OR ScriptBlockText="*robocopy*")) AND ScriptBlockText="*\\\\*")

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((event.code == 4104 AND (TO_LOWER(powershell.file.script_block_text) LIKE "*copy-item*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*copy-item*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*robocopy*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*robocopy*")) AND TO_LOWER(powershell.file.script_block_text) LIKE "*\\\\\\\\*")

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="EventID" type="pcre2">(?i)^4104$</field>    <field name="ScriptBlockText" type="pcre2">(?i)(Copy-Item|copy-item|Robocopy|robocopy)</field>    <field name="ScriptBlockText" type="pcre2">(?i)\\\\</field>    <description>PowerShell script block copies a file from a UNC path</description>    <mitre>      <id>T1074.002</id>    </mitre>  </rule></group>

At a glance

Logsource: powershell / windows
Level: low
Category: data_staging_exfil
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: aa8adf1c-5a06-433a-93d2-2b1edad68875

ATT&CKT1074.002

T1074.002Remote Data Staging

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Evidence

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Noise check0 of 4 fired

Fires on none of the 4 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 4 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1074.002, evaluated against their — events.

Using it

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Exclude known service accounts and scheduled-task contexts that run the listed benign sources, and expect to spend tuning effort narrowing by destination share rather than by verb. On evasion: mapping a drive letter first (net use Z: \\host\share then Copy-Item Z:\file) drops the literal UNC text entirely, and alternate copy mechanisms — [System.IO.File]::Copy, Move-Item, BITS, or an HTTP call against an SMB-adjacent endpoint — bypass both the verb and the UNC-literal checks. Neither bypass changes the technique's mechanics, only its visibility to this specific selector.

Declared by the author

Logon scripts and Group Policy or SCCM/Intune deployment scripts, which are the single most common source of a Copy-Item or robocopy call against a UNC path in any managed estate and run on a predictable schedule under a service or machine account.
Folder-redirection and roaming-profile sync scripts that robocopy a user's Desktop or Documents to a UNC file-server path at logon or logoff — ordinary and expected on every session for estates that use roaming profiles.
Backup and disaster-recovery jobs that Copy-Item a nightly export to a UNC path on a dedicated backup share, producing a burst of identical matches across the fleet at the same time every night.
Build and release scripts that robocopy compiled artefacts to or from an internal UNC build share as part of a CI pipeline running PowerShell on a build agent.

Lessondata staging exfil

data staging exfilAI draft — unreviewed

01 · What this rule detects

AN0194 describes remote data staging: a file transferred or mounted from a remote host, then written into a local staging directory. This corpus already publishes T1074 and T1074.001, both matching on the local write alone — they can see data landing in a staging directory but cannot tell a file that originated on the same host from one pulled across the network. This rule recovers that distinction the only way a single PowerShell script block event can: it requires both a copy verb and a literal UNC path in the same event, so the match itself asserts "this copy names a network location," not just "a file arrived somewhere."

02 · Telemetry you need

Windows PowerShell EventID 4104, product: windows / service: powershell — Script Block Logging, which is off in a default install and in the MS and CIS baselines. Without it enabled, 4104 produces nothing, and a quiet result means blind, not clean. AN0194 also names Sysmon EventID 11 (file_event) and the SMBClient/Security channel's EventID 31001; neither is used here. Sysmon 11 only records the file that was created, never where it came from, so it can't carry a remote-origin signal at all. The SMBClient channel's fields aren't documented with enough confidence to author against under this corpus's own field-verification rule, so it was left out rather than guessed.

03 · How the logic works

Three selections, all ANDed: selection_event pins EventID: 4104; selection_verb requires ScriptBlockText to contain Copy-Item, copy-item, Robocopy, or robocopy; selection_unc requires ScriptBlockText|contains: '\\\\'. That last term is written as four backslash characters in the YAML — worth naming explicitly, because it looks wrong at a glance. Sigma unescapes \\ to one literal backslash, so four characters resolve to two literal backslashes: the UNC prefix. This was flagged for review specifically because it's the exact trap this corpus has hit before, and it checked out clean here — a reviewer initially suspected the translated Kusto/Splunk/ES|QL queries were over-escaping the same sequence, but checking each backend's own escaping rules directly showed the doubled backslashes in the rendered query text are each language's correct encoding of one literal backslash. The rule is sound on this axis in all three renders. What the rule genuinely cannot do is tell direction. Sigma has no way to parse Copy-Item's argument order, so Copy-Item \\host\share\file.txt C:\local (a pull) and Copy-Item C:\local\file.txt \\host\share (a push) match identically. A hit says "this script names a UNC path and a copy verb in the same breath" — nothing more.

04 · Common false positives

All four false positives are routine, scheduled, or IT-managed script activity: logon scripts and Group Policy/SCCM/Intune deployment scripts, described as "the single most common source" of this pattern in any managed estate; folder-redirection and roaming-profile sync scripts running at every logon or logoff; nightly backup jobs producing a synchronized burst across the fleet; and CI/build pipelines robocopying artefacts to an internal build share. That volume is why the rule ships at level: low — the loudest matches are expected, not suspicious.

05 · Detection maturity

tier_1: . Derived from a MITRE scaffold with no query logic, never run against a log line.
tier_2: means confirming Script Block Logging coverage across the fleet first — this rule is worthless without it — then baselining the four disclosed false-positive sources by volume before setting an exclusion list.
tier_3: ** would pair this with the local-staging siblings (T1074/T1074.001) and, where the SMBClient channel's fields get verified, add the direction signal this rule structurally cannot supply.

Related detections3 nearby

Ranked by how alike the detection logic reads, computed offline. Proximity is not evidence — each of these carries its own verification state on its own page.

Share this rule

/u/siemphony/aa8adf1c-5a06-433a-93d2-2b1edad68875

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

PowerShell script block copies a file from a UNC path

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it