Copy From Or To Admin Share Or Sysvol Folder — Detection Rule

Detects a copy command or a copy utility execution to or from an Admin share or remote

Read the full analysis on IntelFusions