Scripted recursive copy sweeping multiple document types

1title: Scripted recursive copy sweeping multiple document types2id: aad6ea77-2853-4827-abf9-9c877c56e2ab3status: experimental4description: |5  Authors a single-event stand-in for AN0531's core signal — "search for and6  copy information fitting set criteria such as file type" — as a PowerShell7  Copy-Item invocation that is both recursive and names several unrelated8  document extensions in one command line, which is what a scripted bulk9  collection sweep looks like at the point it runs versus an ordinary10  one-off copy. MITRE's ProcessCountThreshold and ClipboardCheckRate knobs11  describe a rate over repeated events, which Sigma's lack of aggregation12  support (no `count() by`) makes impossible to express directly, so this13  substitutes "several file types requested together" for "many files copied14  over time" as the single-event proxy for automation. Three limits are15  structural, and none of them is a false positive. Sysmon EventID 1 records16  the process command line only, so this fires solely on a sweep typed inline17  (powershell.exe -Command "Copy-Item -Recurse ... -Include *.doc,*.pdf"); a18  launch of powershell.exe -File collect.ps1, an -EncodedCommand payload, a19  pipeline where -Recurse and -Include sit on Get-ChildItem and the trailing20  Copy-Item carries neither, or plain aliasing (cpi, gci) all put none of the21  matched tokens on the recorded command line, because the cmdlet text lives22  inside the script body this event never captures. Inline invocation is one23  style of scripted collection and not the dominant one for real automation, so24  treat a silent result as unmeasured rather than clean. Second, 'recurse' is25  matched as a bare substring, so -Recurse:$false — recursion explicitly turned26  off, no tree walked — still satisfies that gate. Third, robocopy and xcopy are27  left out of the selector rather than OR-ed in on a different CommandLine28  shape, keeping the rule to one condition all four backends render. This is deliberately not29  the shape already published elsewhere in the corpus: T1005 matches a find/30  grep search for credential and SSH-key filenames, and this matches a31  PowerShell copy of general document types — different tool class, different32  target, no overlap.33  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0186, not hand-written and not tested by its author. Any lab result is on this rule's own page.34references:35  - https://attack.mitre.org/techniques/T111936  - https://attack.mitre.org/detectionstrategies/DET018637author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)38date: 2026-08-1639tags:40  - attack.collection41  - attack.t111942logsource:43  category: process_creation44  product: windows45detection:46  selection_tool:47    Image|endswith:48      - '\powershell.exe'49      - '\pwsh.exe'50  selection_copy_verb:51    CommandLine|contains: 'copy-item'52  selection_recurse_flag:53    CommandLine|contains: 'recurse'54  selection_extension:55    CommandLine|contains:56      - '.doc'57      - '.xls'58      - '.ppt'59      - '.pdf'60      - '.csv'61      - '.txt'62  condition: selection_tool and selection_copy_verb and selection_recurse_flag and selection_extension63falsepositives:64  - "User-profile migration and onboarding/offboarding scripts run by helpdesk tooling, which use Copy-Item -Recurse against a user's Documents folder filtered to common office extensions as their normal operating pattern — in an environment with active migration or provisioning waves this is the largest source of matches."65  - "Backup, e-discovery or legal-hold agents that periodically sweep user document folders and copy matching file types to a review or backup repository as part of routine, scheduled compliance operations."66  - "Software packaging and imaging scripts (SCCM/Intune build tasks) that stage a fixed set of document templates into a reference image using the same cmdlet and flag combination."67level: medium