Lateral Tool Transfer T1570
Tactic: Lateral Movement
Adversaries may transfer tools or other files between systems in a compromised environment. Once brought into the victim environment (i.e., Ingress Tool Transfer) files may then be copied from one system to another to stage adversary tools or other files over the course of an operation.
Events covered
19 catalog events are tagged with this technique by at least one rule.
Authoring guide
These 48 rules share fields, values, and exclusions.
Fields filtered most (45 distinct)
These fields appear most often in rule filters.
Top indicator values (221 distinct)
These values appear most often in rule predicates.
Exclusions (62 distinct)
These values appear most often in top-level exclusions.
Rules under this technique
These vendors publish rules tagged with this technique.
Sigma 10 rules
- BITS payload downloaded via commandline
- BITS payload downloaded via PowerShell
- File with high volume downloaded via BITS
- macOS File Transfer Tool Execution
- Metasploit Or Impacket Service Installation Via SMB PsExec
- Potentially Suspicious File Creation by OpenEDR's ITSMService
- PSEXEC Remote Execution File Artefact
- Rundll32 Execution Without Parameters
- SMB over QUIC Via Net.EXE
- SMB over QUIC Via PowerShell Script
Elastic 17 rules
- Execution via TSClient Mountpoint
- Lateral Movement via Startup Folder
- Potential Lateral Tool Transfer via SMB Share
- Potential Netcat File Listener Established
- Potential Ransomware Behavior - Note Files by System
- PsExec Network Connection
- Remote Execution via File Shares
- Remote File Copy to a Hidden Share
- Remote File Creation in World Writeable Directory
- Scheduled Task Execution at Scale via GPO
- Spike in Remote File Transfers
- Suspicious Execution from a WebDav Share
- Unusual Remote File Creation
- Unusual Remote File Directory
- Unusual Remote File Extension
- Unusual Remote File Size
- Web Server Spawned via Python
Splunk 10 rules
- BITSadmin Execution (PowerShell)
- BITSadmin Execution (Sysmon)
- BITSadmin Execution (Windows Event Log)
- Esentutl Execution (PowerShell)
- Esentutl Execution (Sysmon)
- Esentutl Execution (Windows Event Log)
- Meterpreter Reverse Shell (Windows Event Log)
- Remote Admin Tools (PowerShell)
- Remote Admin Tools (Sysmon)
- Remote Admin Tools (Windows Event Log)
Kusto 10 rules
- [AzureSubscription] Suspicious Azure VM Run Command Execution Detected
- Azure VM Run Command operation executed during suspicious login window
- Azure VM Run Command operations executing a unique PowerShell script
- CTE - Possible Company-Wide C2 Campaign (Multiple Devices, Same Destination)
- Identify Mango Sandstorm powershell commands
- New EXE deployed via Default Domain or Default Domain Controller Policies
- New EXE deployed via Default Domain or Default Domain Controller Policies (ASIM Version)
- New executable via Office FileUploaded Operation
- Remote File Creation with PsExec
- vArmour AppController - SMB Realm Traversal