Techniques › T1570
T1570 Lateral Tool Transfer
lateral movement — ESXi, Linux, macOS, Windows · attack.mitre.org · JSON
1
MITRE detection strategy
4
analytics
6
Sigma rules tagged attack.t1570
1
KEV CVEs mapped here
<p>Adversaries may transfer tools or other files between systems in a compromised environment. Once brought into the victim environment (i.e., Ingress Tool Transfer) files may then be copied from one system to another to stage adversary tools or other files over the course of an operation.</p><p>Adversaries may copy files between internal victim systems to support lateral movement using inherent file sharing protocols such as file sharing over SMB/Windows Admin Shares to connected network shares or with authenticated connections via Remote Desktop Protocol.</p><p>Files can also be transferred using native or otherwise present tools on the victim system, such as scp, rsync, curl, sftp, and ftp. In some cases, adversaries may be able to leverage Web Services such as Dropbox or OneDrive to copy files from one machine to another via shared, automatically synced folders.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
| CVE | Vendor / product | Mapping type | State | Added |
|---|---|---|---|---|
| CVE-2024-4577 | PHP Group PHP | secondary impact | Mapped | 2024-06-12 |
Detection strategy · ATT&CK Enterprise v19.2
- DET0183 Detection Strategy for Lateral Tool Transfer across OS platforms v1.0
AN0516 WindowsCorrelate suspicious file transfers over SMB or Admin$ shares with process creation events (e.g., cmd.exe, powershell.exe, certutil.exe) that do not align with normal administrative behavior. Detect remote file writes followed by execution of transferred binaries.Tunable:
TimeWindowUserContextFilePathWhitelistAN0517 LinuxMonitor scp, rsync, curl, sftp, or ftp processes initiating transfers to internal systems combined with file creation events in unusual directories. Correlate transfer activity with subsequent execution of those binaries.Tunable:AllowedToolsDestinationDirectoriesAN0518 macOSDetect anomalous use of scp, rsync, curl, or third-party sync apps transferring executables into user directories. Correlate new file creation with immediate execution events.macos:unifiedlogFile created in ~/Library/LaunchAgents or executable directories→ DC0039 File CreationTunable:SyncApplicationsEntropyThresholdAN0519 ESXiIdentify lateral transfer via datastore file uploads or internal scp/ssh sessions that result in new VMX/VMDK or script files. Correlate transfer with VM execution or datastore modification.Tunable:DatastoreWhitelistTransferProtocol
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1570
Author: frack113
· 2023-07-21 · logsource: product=windows category=process_creation · 2238d337-42fb-4971-9a68-63570f2aede4
Detects the mounting of Windows SMB shares over QUIC, which can be an unexpected event in some enterprise environments.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-01-21 (modified 2023-02-23) · logsource: product=windows category=file_event · 304afd73-55a5-4bb9-8c21-0b1fc84ea9e4
Detects creation of the PSEXEC key file. Which is created anytime a PsExec command is executed. It gets written to the file system and will be recorded in the USN Journal on the target system
Author: Bartlomiej Czyz, Relativity
· 2021-01-31 (modified 2023-02-28) · logsource: product=windows category=process_creation · 5bb68627-3198-40ca-b458-49f973db8752
Detects rundll32 execution without parameters as observed when running Metasploit windows/smb/psexec exploit module
Author: frack113
· 2023-07-21 · logsource: product=windows category=ps_script · 6df07c3b-8456-4f8b-87bb-fe31ec964cae
Detects the mounting of Windows SMB shares over QUIC, which can be an unexpected event in some enterprise environments
Author: Bartlomiej Czyz, Relativity
· 2021-01-21 (modified 2022-10-05) · logsource: product=windows service=security · 6fb63b40-e02a-403e-9ffd-3bcc1d749442
Detects usage of Metasploit SMB PsExec (exploit/windows/smb/psexec) and Impacket psexec.py by triggering on specific service installation
Author: @kostastsale
· 2026-02-19 · logsource: product=windows category=file_event · 9e4b7d3a-6f2c-4e9a-8d1b-3c5e7a9f2b4d
Detects the creation of potentially suspicious files by OpenEDR's ITSMService process.
The ITSMService is responsible for remote management operations and can create files on the system through the Process Explorer or file management features.
While legitimate for IT operations, creation of executable or script files could indicate unauthorized file uploads, data staging, or malicious file deployment.