Linux Remote File Copy via SCP/RSYNC/SFTP with Remote Host Targeting

Flags Linux command lines using scp/rsync/sftp with remote-target style arguments containing “@” and “:”.

FreeUnreviewedSigmalowv1

linux-remote-file-copy-via-scp-rsync-sftp-with-remote-host-targeting-7a14080d

title: Linux Remote File Copy via SCP/RSYNC/SFTP with Remote Host Targeting
id: 8560ab05-f44b-4165-b32e-0a6206e6ba75
status: stable
description: This rule identifies Linux activity consistent with copying files to or from remote systems using common remote file transfer tools (scp, rsync, sftp) when command arguments include characters indicative of remote targets. Attackers frequently use these utilities for data movement, staging, and lateral transfers during intrusion activity. Telemetry relies on process command-line content that includes the tool invocation alongside “@” and “:” argument patterns.
references:
  - https://www.cisa.gov/stopransomware/ransomware-guide
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/builtin/lnx_file_copy.yml
author: Ömer Günal, Huntrule Team
date: 2020-06-18
tags:
  - attack.command-and-control
  - attack.lateral-movement
  - attack.t1105
logsource:
  product: linux
detection:
  tools:
    - "scp "
    - "rsync "
    - "sftp "
  filter:
    - "@"
    - ":"
  condition: tools and filter
falsepositives:
  - Legitimate administration activities
level: low
license: DRL-1.1
related:
  - id: 7a14080d-a048-4de8-ae58-604ce58a795b
    type: derived

What it detects

This rule identifies Linux activity consistent with copying files to or from remote systems using common remote file transfer tools (scp, rsync, sftp) when command arguments include characters indicative of remote targets. Attackers frequently use these utilities for data movement, staging, and lateral transfers during intrusion activity. Telemetry relies on process command-line content that includes the tool invocation alongside “@” and “:” argument patterns.

Known false positives

Legitimate administration activities

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.