Copy From Or To Admin Share Or Sysvol Folder

Google SecOps@GoogleSecOps

•updated Jun 6, 2025•0•0•0

Detects a copy command or a copy utility execution to or from an Admin share or remote