marcos.luna
56 lines
1.5 KiB
Markdown
56 lines
1.5 KiB
Markdown
# cp - Copy File
|
|
|
|
Copy a file from a source location to a destination path on the target system.
|
|
|
|
## Description
|
|
|
|
The `cp` command copies a file from a source location to a destination path on the target system. The destination file will be overwritten if it already exists. This command creates a 'File Write' artifact for tracking purposes.
|
|
|
|
## Syntax
|
|
|
|
```
|
|
cp <source_path> <destination_path>
|
|
```
|
|
|
|
## Parameters
|
|
|
|
- `source_path` (required): Path to the source file
|
|
- `destination_path` (required): Path where the file will be copied to
|
|
|
|
## Examples
|
|
|
|
```
|
|
cp C:\Users\file.txt C:\temp\backup.txt
|
|
cp source.exe C:\Windows\Temp\malware.exe
|
|
cp config.ini config.ini.bak
|
|
```
|
|
|
|
## Features
|
|
|
|
- Supports both absolute and relative paths (relative paths are resolved using the current working directory)
|
|
- The destination file will be overwritten if it already exists
|
|
- Creates a 'File Write' artifact for the destination file
|
|
- Useful for creating backups, moving files, or preparing payloads in staging directories
|
|
|
|
## Output
|
|
|
|
```
|
|
[cp] File copied: C:\Users\file.txt -> C:\temp\backup.txt
|
|
```
|
|
|
|
## OPSEC Considerations
|
|
|
|
- File writes are logged by EDR/XDR solutions
|
|
- Copying to sensitive locations (System32, Windows, Program Files) may trigger alerts
|
|
- File write artifacts are automatically tracked
|
|
|
|
## Related
|
|
|
|
[Artifacts Support](../../../features.md#artifacts-support)
|
|
|
|
---
|
|
|
|
**Command Category:** File System
|
|
**Requires Admin:** No
|
|
**MITRE ATT&CK:** [T1105 - Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105/)
|