BIOC
Informational
✕
Remote file copy
Remote copy operation of a file using rsync or scp or sftp.
- Module:
- Platform Analytics
- Agent event type:
- Process execution
- Category:
- Lateral Movement
- Status:
- Enabled
ATT&CK tactics: Lateral Movement (TA0008)
ATT&CK techniques: Lateral Tool Transfer (T1570)
Indicator:
Process action type = execution AND target process name = rsync , scp , sftp Host host os = linux , macos
Preventable: yes