wiki created

documentation-payload/Cazalla/commands/cp.md

@@ -0,0 +1,55 @@
+# cp - Copy File
+
+Copy a file from a source location to a destination path on the target system.
+
+## Description
+
+The `cp` command copies a file from a source location to a destination path on the target system. The destination file will be overwritten if it already exists. This command creates a 'File Write' artifact for tracking purposes.
+
+## Syntax
+
+```
+cp <source_path> <destination_path>
+```
+
+## Parameters
+
+- `source_path` (required): Path to the source file
+- `destination_path` (required): Path where the file will be copied to
+
+## Examples
+
+```
+cp C:\Users\file.txt C:\temp\backup.txt
+cp source.exe C:\Windows\Temp\malware.exe
+cp config.ini config.ini.bak
+```
+
+## Features
+
+- Supports both absolute and relative paths (relative paths are resolved using the current working directory)
+- The destination file will be overwritten if it already exists
+- Creates a 'File Write' artifact for the destination file
+- Useful for creating backups, moving files, or preparing payloads in staging directories
+
+## Output
+
+```
+[cp] File copied: C:\Users\file.txt -> C:\temp\backup.txt
+```
+
+## OPSEC Considerations
+
+- File writes are logged by EDR/XDR solutions
+- Copying to sensitive locations (System32, Windows, Program Files) may trigger alerts
+- File write artifacts are automatically tracked
+
+## Related
+
+[Artifacts Support](../../../features.md#artifacts-support)
+
+---
+
+**Command Category:** File System  
+**Requires Admin:** No  
+**MITRE ATT&CK:** [T1105 - Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105/)