Possible Remote File Copy (via linux)

title: Possible Remote File Copy (via linux)
id: 080c6170-123a-5a8c-82c3-77495c934105
status: stable
description: This rule detects the use of tools that copy files from or to remote systems
references:
    - https://attack.mitre.org/techniques/T1105/
    - https://www.cisa.gov/stopransomware/ransomware-guide
author: Huntrule Team
date: 2026-02-24
tags:
    - attack.command-and-control
    - attack.lateral-movement
    - attack.t1105
logsource:
    product: linux
detection:
    tools:
        - 'scp '
        - 'rsync '
        - 'sftp '
    filter:
        - '@'
        - ':'
    condition: tools and filter
falsepositives:
    - Unknown
level: low