Cross-source coverage

T1570 / ATT&CK

Lateral Tool Transfer

69 rules · 61 families across 8 sources.

Showing deprecated rules · back to the default

From MITRE ATT&CK 19.2

Adversaries may transfer tools or other files between systems in a compromised environment. Once brought into the victim environment (i.e., Ingress Tool Transfer) files may then be copied from one system to another to stage adversary tools or other files over the course of an operation.

Adversaries may copy files between internal victim systems to support lateral movement using inherent file sharing protocols such as file sharing over SMB/Windows Admin Shares to connected network shares or with authenticated connections via Remote Desktop Protocol.

Files can also be transferred using native or otherwise present tools on the victim system, such as scp, rsync, curl, sftp, and ftp. In some cases, adversaries may be able to leverage Web Services such as Dropbox or OneDrive to copy files from one machine to another via shared, automatically synced folders.

Platforms
ESXi · Linux · macOS · Windows
Telemetry
WinEventLog:SecurityWinEventLog:Sysmonauditd:SYSCALLauditd:FILEmacos:unifiedlogesxi:vmkernelesxi:hostd

How MITRE says to detect it DET0183

Detection Strategy for Lateral Tool Transfer across OS platforms

Windows Analytic 0516

Correlate suspicious file transfers over SMB or Admin$ shares with process creation events (e.g., cmd.exe, powershell.exe, certutil.exe) that do not align with normal administrative behavior. Detect remote file writes followed by execution of transferred binaries.

  • WinEventLog:Security EventCode=5140
  • WinEventLog:Sysmon EventCode=11
  • WinEventLog:Sysmon EventCode=1

Linux Analytic 0517

Monitor scp, rsync, curl, sftp, or ftp processes initiating transfers to internal systems combined with file creation events in unusual directories. Correlate transfer activity with subsequent execution of those binaries.

  • auditd:SYSCALL execve: Invocation of scp, rsync, curl, or sftp
  • auditd:FILE create: New file created in system binaries or temp directories

macOS Analytic 0518

Detect anomalous use of scp, rsync, curl, or third-party sync apps transferring executables into user directories. Correlate new file creation with immediate execution events.

  • macos:unifiedlog Execution of scp, rsync, curl with remote destination
  • macos:unifiedlog File created in ~/Library/LaunchAgents or executable directories

ESXi Analytic 0519

Identify lateral transfer via datastore file uploads or internal scp/ssh sessions that result in new VMX/VMDK or script files. Correlate transfer with VM execution or datastore modification.

  • esxi:vmkernel Upload of file to datastore
  • esxi:hostd scp/ssh used to move file across hosts

View on attack.mitre.org ↗

Emerging Threats Open

31 rules · 23 families
Detection Severity Format
ET ATTACK_RESPONSE Possible ELEFANTE/ElephantBeetle Lateral Movement Activity High Suricata
ET HUNTING schtasks change Command in HTTP Body Response High Suricata
ET HUNTING schtasks delete Command in HTTP Body Response High Suricata
ET HUNTING schtasks end Command in HTTP Body Response High Suricata
ET HUNTING schtasks query Command in HTTP Body Response High Suricata
ET HUNTING schtasks run Command in HTTP Body Response High Suricata
ET INFO Possible Lateral Movement - File Creation Request in Remote System32 Directory (T1105) High Suricata
ET MALWARE [CISA AA21-291A] Possible BlackMatter Ransomware Lateral Movement High Suricata
ET POLICY Powershell Command With Encoded Argument Over SMB - Likely Lateral Movement 2 variants High Suricata
ET POLICY Powershell Command With Execution Bypass Argument Over SMB - Likely Lateral Movement 2 variants High Suricata

+ 21 more from Emerging Threats Open → showing the 10 highest-severity

elastic/detection-rules

16 rules
Detection Severity Format
Execution via TSClient Mountpoint High Elastic TOML
Lateral Movement via Startup Folder High Elastic TOML
Suspicious Execution from a WebDav Share High Elastic TOML
Potential Lateral Tool Transfer via SMB Share Medium Elastic TOML
Potential Ransomware Behavior - Note Files by System Medium Elastic TOML
Remote Execution via File Shares Medium Elastic TOML
Remote File Copy to a Hidden Share Medium Elastic TOML
Remote File Creation in World Writeable Directory Medium Elastic TOML
Scheduled Task Execution at Scale via GPO Medium Elastic TOML
Web Server Spawned via Python Medium Elastic TOML

+ 6 more from elastic/detection-rules → showing the 10 highest-severity

Azure/Azure-Sentinel

9 rules
Detection Severity Format
Azure VM Run Command operation executed during suspicious login window High KQL
Identify Mango Sandstorm powershell commands High KQL
New EXE deployed via Default Domain or Default Domain Controller Policies (ASIM Version) High KQL
Azure VM Run Command operations executing a unique PowerShell script Medium KQL
Azure Storage file upload from VPS Providers Undefined KQL
Azure VM Run Command linked with MDE Undefined KQL
Storage Account Key Enumeration Undefined KQL
Storage Alert Correlation with CommonSecurityLogs and StorageLogs Undefined KQL
Storage File Seen on Endpoint Undefined KQL

SigmaHQ/sigma

6 rules
Detection Severity Format
Metasploit Or Impacket Service Installation Via SMB PsExec High Sigma
PSEXEC Remote Execution File Artefact High Sigma
Rundll32 Execution Without Parameters High Sigma
Potentially Suspicious File Creation by OpenEDR's ITSMService Medium Sigma
SMB over QUIC Via Net.EXE Medium Sigma
SMB over QUIC Via PowerShell Script Medium Sigma

Wazuh Core Ruleset

4 rules
Detection Severity Format
binary created in Windows root folder by WinRM process · win.eventdata.image = (?i)wsmprovhost\.exe Medium Wazuh XML
Executable dropped in Windows root folder Medium Wazuh XML
Executable dropped in Windows root folder by process. Possible abuse of Windows admin shares · win.eventdata.image = (?i)PAExec., win.eventdata.targetFilename = (?i)[c-z]:\\\\Windows\\\\.+\.(exe|com|dll|vbs|js|bat|cmd|pi… Medium Wazuh XML
Possible abuse of Windows admin shares by binary dropped in Windows root folder by system process Medium Wazuh XML

chronicle/detection-rules

1 rule
Detection Severity Format
mitre_attack_T1570_suspicious_command_psexec Informational YARA-L

elastic/protections-artifacts

1 rule
Detection Severity Format
Potential Netcat File Listener Established Undefined Elastic TOML

socfortress/Wazuh-Rules

1 rule
Detection Severity Format
Sysmon - Event 1: Process creation · technique_name=NetUse QUIC (T1570) High Wazuh XML

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.