Copy or archive tool targets documents on a non-system drive letter

Siemphony@siemphonylowT1025unverified

Matches AN1410's "mounts a USB device and begins enumerating, copying, or compressing files using scripting engines, cmd, or remote access tools" in the single event Sigma can express: a shell, scripting host or archiver whose command line names both a drive letter other than C: and a document extension. MITRE's TargetFileType knob is populated here with common office and archive formats. The VolumeLabel and TimeWindow knobs have no equivalent — Sigma process_creation carries no volume metadata to confirm the target letter is actually removable rather than a second internal disk or a persistent network mapping, and there is no cross-event join available to tie this command line back to the System EventID 2003 drive-arrival record the brief also offers, so a quiet result only means no matching command line was seen, not that no media was mounted. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0511, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where (((FolderPath endswith "\\cmd.exe" or FolderPath endswith "\\powershell.exe" or FolderPath endswith "\\pwsh.exe" or FolderPath endswith "\\robocopy.exe" or FolderPath endswith "\\xcopy.exe" or FolderPath endswith "\\wscript.exe" or FolderPath endswith "\\cscript.exe") and (ProcessCommandLine contains " D:\\" or ProcessCommandLine contains " E:\\" or ProcessCommandLine contains " F:\\" or ProcessCommandLine contains " G:\\" or ProcessCommandLine contains " H:\\")) and (ProcessCommandLine contains ".docx" or ProcessCommandLine contains ".xlsx" or ProcessCommandLine contains ".pptx" or ProcessCommandLine contains ".pdf" or ProcessCommandLine contains ".csv" or ProcessCommandLine contains ".zip" or ProcessCommandLine contains ".rar" or ProcessCommandLine contains ".7z"))

Splunk · SPL

Run this as a search.

index=* (((Image="*\\cmd.exe" OR Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\robocopy.exe" OR Image="*\\xcopy.exe" OR Image="*\\wscript.exe" OR Image="*\\cscript.exe") AND (CommandLine="* D:\\*" OR CommandLine="* E:\\*" OR CommandLine="* F:\\*" OR CommandLine="* G:\\*" OR CommandLine="* H:\\*")) AND (CommandLine="*.docx*" OR CommandLine="*.xlsx*" OR CommandLine="*.pptx*" OR CommandLine="*.pdf*" OR CommandLine="*.csv*" OR CommandLine="*.zip*" OR CommandLine="*.rar*" OR CommandLine="*.7z*"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (((TO_LOWER(process.executable) LIKE "*\\\\cmd.exe" OR TO_LOWER(process.executable) LIKE "*\\\\powershell.exe" OR TO_LOWER(process.executable) LIKE "*\\\\pwsh.exe" OR TO_LOWER(process.executable) LIKE "*\\\\robocopy.exe" OR TO_LOWER(process.executable) LIKE "*\\\\xcopy.exe" OR TO_LOWER(process.executable) LIKE "*\\\\wscript.exe" OR TO_LOWER(process.executable) LIKE "*\\\\cscript.exe") AND (TO_LOWER(process.command_line) LIKE "* d:\\\\*" OR TO_LOWER(process.command_line) LIKE "* e:\\\\*" OR TO_LOWER(process.command_line) LIKE "* f:\\\\*" OR TO_LOWER(process.command_line) LIKE "* g:\\\\*" OR TO_LOWER(process.command_line) LIKE "* h:\\\\*")) AND (TO_LOWER(process.command_line) LIKE "*.docx*" OR TO_LOWER(process.command_line) LIKE "*.xlsx*" OR TO_LOWER(process.command_line) LIKE "*.pptx*" OR TO_LOWER(process.command_line) LIKE "*.pdf*" OR TO_LOWER(process.command_line) LIKE "*.csv*" OR TO_LOWER(process.command_line) LIKE "*.zip*" OR TO_LOWER(process.command_line) LIKE "*.rar*" OR TO_LOWER(process.command_line) LIKE "*.7z*"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)(\\cmd\.exe$|\\powershell\.exe$|\\pwsh\.exe$|\\robocopy\.exe$|\\xcopy\.exe$|\\wscript\.exe$|\\cscript\.exe$)</field>    <field name="CommandLine" type="pcre2">(?i)( D:\\| E:\\| F:\\| G:\\| H:\\)</field>    <field name="CommandLine" type="pcre2">(?i)(\.docx|\.xlsx|\.pptx|\.pdf|\.csv|\.zip|\.rar|\.7z)</field>    <description>Copy or archive tool targets documents on a non-system drive letter</description>    <mitre>      <id>T1025</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: low
Category: data_staging_exfil
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 1cb5eedb-101d-4b24-8376-d153ee9e7ccb

ATT&CKT1025

T1025Data from Removable Media

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessondata staging exfil

data staging exfilAI draft — unreviewed

01 · What this rule detects

AN1410 describes an adversary who mounts a USB device, then enumerates, copies, or compresses files using scripting engines, cmd, or remote access tools. This rule covers only the copy/compress half of that chain, as a single process_creation event: a shell, scripting host, or archiver whose command line names both a drive letter outside C: and a document/archive extension. It cannot see the mount step itself (System EventID 2003, listed in the brief) or join to it — Sigma process_creation carries no volume metadata, so a hit never proves the target letter is removable rather than a second internal disk or a mapped network share.

02 · Telemetry you need

Sysmon EventID 1 (Image, CommandLine) is the intended source, per category: process_creation / product: windows. Splunk, Elastic, and Wazuh render it directly, and translations.json shows no backend refusing this logsource. Sentinel maps it to SecurityEvent 4688 (NewProcessName / CommandLine) — but 4688's CommandLine field is empty unless "Include command line in process creation events" is enabled via audit policy, which is off by default. Nothing in the rule states this, so a Sentinel deployment can silently return zero rows for a policy reason indistinguishable from "nothing happened."

03 · How the logic works

Three ANDed selections. selection_tool matches seven interpreters via Image|endswith. selection_offdrive matches CommandLine|contains against ' D:\', ' E:\' ... ' H:\' — a literal space immediately before the letter. selection_target matches CommandLine|contains against MITRE's TargetFileType knob, populated here with office formats (.docx/.xlsx/.pptx/.pdf/.csv) plus archive formats (.zip/.rar/.7z) — that specific extension list is the rule author's addition, not something MITRE ships. MITRE's VolumeLabel and TimeWindow knobs have no equivalent field anywhere in this rule: nothing ties the event back to a device-arrival record, so this precursor-only scope is by design, not an oversight.

04 · Common false positives

The review's central catch: the space-anchored ' D:\' match is defeated by any quoted path — robocopy "D:\My Documents" C:\Backup never contains the literal substring ' D:\' because a quote sits between the space and the letter. Windows user folders routinely contain spaces, so quoted invocations of exactly these tools are the common case, not the exception — this is a coverage hole as much as a noise source. Two of the seven tools, wscript.exe and cscript.exe, are largely decorative: script-based collectors typically hardcode the target path inside the .vbs body rather than passing it as an argument, so they rarely satisfy selection_offdrive/selection_target in the same event. Genuine false positives come from multi-disk workstations syncing to a second internal volume, IT/backup jobs mirroring documents to an external drive with robocopy, and installer/DVD-image staging that copies .zip or .pdf files off D:/E:. One case is missing from the rule's own falsepositives list: DLP or quarantine tooling that itself shells out to robocopy/xcopy to relocate flagged files to a quarantine volume in the D:-H: range.

05 · Detection maturity

tier_1: .** Scaffolded from MITRE's AN1410 description with no execution history. translations.json shows a clean render across all four backends, but a clean render says nothing about hit quality. The space-anchored evasion and the Sentinel audit-policy gap were both found by static review, not by running the rule — real precision and recall stay unknown until this runs read-only against actual endpoint activity.

Tuning & false positivesexperimental · 3 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Replace the space-anchored contains list with a regex that tolerates a leading quote or other boundary character before the drive letter — e.g. CommandLine|re: '[ "''][D-H]:\\\\' — to close the quoted-path gap. Either drop wscript.exe/cscript.exe or document that they only fire when the drive and path are passed inline. Before trusting a null result in Sentinel, confirm the 4688 command-line audit policy is enabled. Add quarantine/DLP tooling to the false-positive list, and treat drive letters past H: or driveless mount points as a known blind spot.

Declared by the author

Employees on multi-disk workstations who routinely copy documents to a second internal disk or a persistently mapped network share assigned a drive letter in the D:-H: range, using PowerShell, cmd, or robocopy for a scheduled sync — a common daily pattern on machines with more than one volume.
IT or backup staff running robocopy or xcopy jobs that mirror a user's documents to an external backup drive as a sanctioned data-protection task, which produces exactly this tool-plus-drive-plus-extension combination.
Software installers and update packages staged on a D: or E: optical/DVD image or a secondary partition, whose setup scripts copy .zip or .pdf documentation files as part of installation.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1025, evaluated against their process_creation events.

Share this rule

/u/siemphony/1cb5eedb-101d-4b24-8376-d153ee9e7ccb

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Copy or archive tool targets documents on a non-system drive letter

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it