PUA - HoboCopy Execution

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects the execution of HoboCopy, a command-line tool that can be used to copy locked files using Volume Shadow Copy Service (VSS). This tool can be abused by attackers to copy sensitive files like SAM, SYSTEM, or NTDS.dit. Event though it can be used for legitimate backup purposes, its presence in modern Windows environments is very rare and potentially associated with malicious activity.

2026-03-27 00:00:00

None

5a8a5e24-1e7b-4a3c-8f5d-2b9e4c6d8f1a

attack.collection attack.t1005 attack.credential-access attack.t1003.002 attack.t1003.003

Nextron Sigma feed only (private)