tfMITRE ATT&CK technique

Lateral Tool Transfer T1570

Tactic: Lateral Movement
Platforms: ESXi, Linux, macOS, Windows
Version: 1.4
Created: 11 March 2020
Last modified: 12 May 2026
Contributor: Shailesh Tiwary (Indian Army)

Adversaries may transfer tools or other files between systems in a compromised environment. Once brought into the victim environment (i.e., Ingress Tool Transfer) files may then be copied from one system to another to stage adversary tools or other files over the course of an operation.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsTop 9%

Threat groups91st percentile · 90% of ATT&CK techniques have fewer threat groups attributed.

CampaignsTop 4%

Campaigns96th percentile · 95% of ATT&CK techniques have fewer campaigns recorded.

Tools & malwareTop 13%

Tools & malware87th percentile · 87% of ATT&CK techniques have fewer tools implementing them.

Detection rules69th pct

Detection rules69th percentile · 67% of ATT&CK techniques have fewer detection rules written.

tfMITRE ATT&CK technique

Lateral Tool Transfer T1570

Tactic: Lateral Movement
Platforms: ESXi, Linux, macOS, Windows
Version: 1.4
Created: 11 March 2020
Last modified: 12 May 2026
Contributor: Shailesh Tiwary (Indian Army)

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsTop 9%

Threat groups91st percentile · 90% of ATT&CK techniques have fewer threat groups attributed.

CampaignsTop 4%

Campaigns96th percentile · 95% of ATT&CK techniques have fewer campaigns recorded.

Tools & malwareTop 13%

Tools & malware87th percentile · 87% of ATT&CK techniques have fewer tools implementing them.

Detection rules69th pct

Detection rules69th percentile · 67% of ATT&CK techniques have fewer detection rules written.

Lateral Tool Transfer MITRE reference T1570

Top 9%of all ATT&CK techniques for number of groups

19 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

Medusa GroupG1051 ↗

Has utilized legitimate software services such as PDQ Deploy to transfer malicious binaries and tools to other victimized hosts within the target environment.1

created 2025-10-151 reference

UNC3886G1048 ↗

Has utilzed Python scripts to transfer files between ESXi hosts and guest VMs.1

created 2025-05-291 reference

Velvet AntG1047 ↗

Transferred files laterally within victim networks through the Impacket toolkit.1

created 2025-03-141 reference

Storm-1811G1046 ↗

Has used the Impacket toolset to move and remotely execute payloads to other hosts in victim networks.1

created 2025-03-141 reference

BlackByteG1043 ↗

Transfered tools such as Cobalt Strike and the AnyDesk remote access tool during operations using SMB shares.1

created 2024-12-161 referenceaka Hecamede

INC RansomG1032 ↗

Has used a rapid succession of copy commands to install a file encryption executable across multiple endpoints within compromised infrastructure.1 2

created 2024-06-062 referencesaka GOLD IONIC

All 19 groups for this technique · 6 newest in this preview

9 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.

SharePoint ToolShell ExploitationC0058 ↗

During SharePoint ToolShell Exploitation, threat actors used Impacket to remotely stage and execute payloads via WMI.1

2025

2025 Poland Wiper AttacksC0063 ↗

During the 2025 Poland Wiper Attacks, the adversaries had placed the malicious payload on an accessible network share to facilitate propagation.1 2 3

2025

2022 Ukraine Electric Power AttackC0034 ↗

During the 2022 Ukraine Electric Power Attack, Sandworm Team used a Group Policy Object (GPO) to copy CaddyWiper's executable msserver.exe from a staging server to a local hard drive before deployment.1

2022

C0018C0018 ↗

During C0018, the threat actors transferred the SoftPerfect Network Scanner and other tools to machines in the network using AnyDesk and PDQ Deploy.1 2

2022

C0015C0015 ↗

During C0015, the threat actors used WMI to load Cobalt Strike onto additional hosts within a compromised network.1

2021

HomeLand JusticeC0038 ↗

During HomeLand Justice, threat actors initiated a process named Mellona.exe to spread the ROADSWEEP file encryptor and a persistence script to a list of internal machines.1

2021–2022

All 9 campaigns for this technique · 6 newest in this preview

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
File CreationDC0039	WinEventLog:Sysmon	EventCode=11
Network Share AccessDC0102	WinEventLog:Security	EventCode=5140

Field	What you tune
TimeWindow	Time period between file transfer and execution used to correlate events
UserContext	Accounts allowed to perform legitimate administrative transfers
FilePathWhitelist	Exclude known legitimate software update directories

Data component	Name	Channel
File CreationDC0039	auditd:FILE	create: New file created in system binaries or temp directories
Command ExecutionDC0064	auditd:SYSCALL	execve: Invocation of scp, rsync, curl, or sftp

Field	What you tune
AllowedTools	Define legitimate transfer utilities expected in the environment
DestinationDirectories	Restrict to suspicious or non-standard directories for transferred files

Data component	Name	Channel
Process CreationDC0032	macos:unifiedlog	Execution of scp, rsync, curl with remote destination
File CreationDC0039	macos:unifiedlog	File created in ~/Library/LaunchAgents or executable directories

Lateral Tool Transfer T1570

Lateral Tool Transfer T1570

Lateral Tool Transfer MITRE reference T1570

Lateral Tool Transfer MITRE reference T1570

Offense vs defense T1570

Lateral Tool Transfer detection strategy DET0183

Detection Strategy for Lateral Tool Transfer across OS platforms

Log sources

Tunable fields

Log sources

Tunable fields

Log sources

Tunable fields

Log sources

Tunable fields

D3FEND techniques

Data model references

Implementations

D3FEND techniques

Data model references

Implementations

D3FEND techniques

Data model references

Implementations

Lateral Tool Transfer detections T1570

Lateral Tool Transfer detections T1570

Field	What you tune
SyncApplications	Whitelisted apps like Dropbox or OneDrive if sanctioned
EntropyThreshold	Adjust threshold for unusual filenames/hashes transferred internally

Data component	Name	Channel
File MetadataDC0059	esxi:vmkernel	Upload of file to datastore
Command ExecutionDC0064	esxi:hostd	scp/ssh used to move file across hosts

Field	What you tune
DatastoreWhitelist	Known authorized paths for legitimate VM operations
TransferProtocol	Protocols allowed for intra-VM host transfers

Object	Action	Field
process	create	image_path
process	create	proto_info
process	create	hostname

Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID
Detects usage of Metasploit SMB PsExec (exploit/windows/smb/psexec) and Impacket psexec.py by trigge (...)	Unsupported	unsupported	service	windows	WinEventLog System	Lateral Movement Lateral Tool Transfer Lateral Movement Remote Services SMB/Windows Admin Shares Execution System Services Service Execution	-	high	Bartlomiej Czyz, Relativity	2021-01-21	2022-03-21	1a17ce75-ff0d-4f02-9709-2b7bb5618cf0
Detects usage of Metasploit SMB PsExec (exploit/windows/smb/psexec) and Impacket psexec.py by trigge (...)	Generic	test	service	windows	WinEventLog Security	Lateral Movement Lateral Tool Transfer Lateral Movement Remote Services SMB/Windows Admin Shares Execution System Services Service Execution	-	high	Bartlomiej Czyz, Relativity	2021-01-21	2022-10-05	6fb63b40-e02a-403e-9ffd-3bcc1d749442
Detects the creation of potentially suspicious files by OpenEDR's ITSMService process. (...)	Generic	experimental	file_event	windows	Sysmon	Command and Control Ingress Tool Transfer Lateral Movement Lateral Tool Transfer Command and Control Remote Access Tools	-	medium	@kostastsale	2026-02-19	—	9e4b7d3a-6f2c-4e9a-8d1b-3c5e7a9f2b4d
Detects creation of the PSEXEC key file. (...)	Generic	test	file_event	windows	Sysmon	Persistence Create Account Domain Account Persistence, Privilege Escalation Create or Modify System Process Windows Service Lateral Movement Lateral Tool Transfer	-	high	Nasreddine Bencherchali (Nextron Systems)	2023-01-21	2023-02-23	304afd73-55a5-4bb9-8c21-0b1fc84ea9e4
Detects rundll32 execution without parameters as observed when running Metasploit windows/smb/psexec (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Lateral Movement Lateral Tool Transfer Lateral Movement Remote Services SMB/Windows Admin Shares Execution System Services Service Execution	-	high	Bartlomiej Czyz, Relativity	2021-01-31	2023-02-28	5bb68627-3198-40ca-b458-49f973db8752
Detects the mounting of Windows SMB shares over QUIC, which can be an unexpected event in some enterprise environments.	Hunting	test	process_creation	windows	Sysmon · WinEventLog Security	Lateral Movement Lateral Tool Transfer	-	medium	frack113	2023-07-21	—	2238d337-42fb-4971-9a68-63570f2aede4
Detects the mounting of Windows SMB shares over QUIC, which can be an unexpected event in some enter (...)	Hunting	test	ps_script	windows	PowerShell	Lateral Movement Lateral Tool Transfer	-	medium	frack113	2023-07-21	—	6df07c3b-8456-4f8b-87bb-fe31ec964cae