Applied Cybernetics Group
T1570 Lateral Tool Transfer
- Technique
T1570- Tactics
- Lateral Movement
- Research, 90 days
- 1
- KEV CVEs mapped
- 1
- SigmaHQ rules
- 6
- Elastic, Splunk
- 16
- thrunt rules
- 0
- Upstream
- https://attack.mitre.org/techniques/T1570
MITRE description
Adversaries may transfer tools or other files between systems in a compromised environment. Once brought into the victim environment (i.e., [Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105)) files may then be copied from one system to another to stage adversary tools or other files over the course of an operation. Adversaries may copy files between internal victim systems to support lateral movement using inherent file sharing protocols such as file sharing over [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002) to connected network shares or with authenticated connections via [Remote Desktop Protocol](https://attack.mitre.org/techniques/T1021/001).(Citation: Unit42 LockerGoga 2019) Files can also be transferred using native or otherwise present tools on the victim system, such as scp, rsync, curl, sftp, and [ftp](https://attack.mitre.org/software/S0095). In some cases, adversaries may be able to leverage [Web Service](https://attack.mitre.org/techniques/T1102)s such as Dropbox or OneDrive to copy files from one machine to another via shared, automatically synced folders.(Citation: Dropbox Malware Sync)
KEV CVEs mapped to this technique
MITRE CTID maps these KEV CVEs to this technique by hand. They are the actively exploited vulnerabilities behind this technique's KEV signal.
Research citing this technique
Reports and advisories from the last 90 days that cite this technique.
-
2026-10-29Cisco Talos: IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases
Detection coverage
SigmaHQ community rules
- SMB over QUIC Via PowerShell Script (threat-hunting)
- SMB over QUIC Via Net.EXE (threat-hunting)
- Metasploit Or Impacket Service Installation Via SMB PsExec (core)
- Potentially Suspicious File Creation by OpenEDR's ITSMService (core)
- PSEXEC Remote Execution File Artefact (core)
- Rundll32 Execution Without Parameters (core)
Elastic and Splunk rules
- Unusual Remote File Size (elastic)
- Unusual Remote File Directory (elastic)
- Unusual Remote File Extension (elastic)
- Spike in Remote File Transfers (elastic)
- Web Server Spawned via Python (elastic)
- Remote File Creation in World Writeable Directory (elastic)
- Unusual Remote File Creation (elastic)
- PsExec Network Connection (elastic)
- Suspicious Execution from a WebDav Share (elastic)
- Potential Ransomware Behavior - Note Files by System (elastic)
- Potential Lateral Tool Transfer via SMB Share (elastic)
- Execution via TSClient Mountpoint (elastic)
- Remote Execution via File Shares (elastic)
- Remote File Copy to a Hidden Share (elastic)
- Lateral Movement via Startup Folder (elastic)
- Scheduled Task Execution at Scale via GPO (elastic)