Medusa GroupG1051 ↗
Has utilized legitimate software services such as PDQ Deploy to transfer malicious binaries and tools to other victimized hosts within the target environment.1
tfMITRE ATT&CK technique
Lateral Tool Transfer T1570
- Tactic
- Lateral Movement
- Platforms
- ESXi, Linux, macOS, Windows
- Version
- 1.4
- Created
- 11 March 2020
- Last modified
- 12 May 2026
- Contributor
- Shailesh Tiwary (Indian Army)
Adversaries may transfer tools or other files between systems in a compromised environment. Once brought into the victim environment (i.e., Ingress Tool Transfer) files may then be copied from one system to another to stage adversary tools or other files over the course of an operation.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
19
Threat groupsTop 9%
Threat groups91st percentile · 91% of ATT&CK techniques have this many threat groups attributed or fewer.9
CampaignsTop 4%
Campaigns96th percentile · 96% of ATT&CK techniques have this many campaigns recorded or fewer.27
Tools & malwareTop 13%
Tools & malware87th percentile · 87% of ATT&CK techniques have this many tools implementing them or fewer.7
Detection rules69th pct
Detection rules69th percentile · 69% of ATT&CK techniques have this many detection rules written or fewer.Lateral Tool Transfer MITRE reference T1570
Top 9%of all ATT&CK techniques for number of groups
19 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
UNC3886G1048 ↗
Has utilzed Python scripts to transfer files between ESXi hosts and guest VMs.1
Velvet AntG1047 ↗
Transferred files laterally within victim networks through the Impacket toolkit.1
Storm-1811G1046 ↗
Has used the Impacket toolset to move and remotely execute payloads to other hosts in victim networks.1
BlackByteG1043 ↗
Transfered tools such as Cobalt Strike and the AnyDesk remote access tool during operations using SMB shares.1
INC RansomG1032 ↗
Has used a rapid succession of copy commands to install a file encryption executable across multiple endpoints within compromised infrastructure.12
All 19 groups for this technique · 6 newest in this preview
9 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
SharePoint ToolShell ExploitationC0058 ↗
During SharePoint ToolShell Exploitation, threat actors used Impacket to remotely stage and execute payloads via WMI.1
2025 Poland Wiper AttacksC0063 ↗
During the 2025 Poland Wiper Attacks, the adversaries had placed the malicious payload on an accessible network share to facilitate propagation.123
2022 Ukraine Electric Power AttackC0034 ↗
During the 2022 Ukraine Electric Power Attack, Sandworm Team used a Group Policy Object (GPO) to copy CaddyWiper's executable msserver.exe from a staging server to a local hard drive before deployment.1
C0018C0018 ↗
During C0018, the threat actors transferred the SoftPerfect Network Scanner and other tools to machines in the network using AnyDesk and PDQ Deploy.12
C0015C0015 ↗
During C0015, the threat actors used WMI to load Cobalt Strike onto additional hosts within a compromised network.1
HomeLand JusticeC0038 ↗
During HomeLand Justice, threat actors initiated a process named Mellona.exe to spread the ROADSWEEP file encryptor and a persistence script to a list of internal machines.1
All 9 campaigns for this technique · 6 newest in this preview
27 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
SameCoinS9030 ↗
Can copy its wiper executable to remote machines within the same Active Directory.1
QilinS1242 ↗
Has used PsExec to distribute a second encryptor, named encryptor_1.exe, across the targeted environment.1
HavocS1229 ↗
Has the ability to copy files from one location to another.1
VIRTUALPIES1218 ↗
Has file transfer capabilities.1
VIRTUALPITAS1217 ↗
Is capable of file transfer and arbitrary command execution.1
BlackByte RansomwareS1180 ↗
Spreads itself laterally by writing the JavaScript launcher file to mapped shared folders.1
All 27 software entries for this technique · 6 newest in this preview
Offense vs defense T1570
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 7Sigma rules (cumulative) · 7Splunk ESCU (cumulative) · 0
first rule: 2021 Q1 · 7 of 9 campaigns plotted (2016 Ukraine Electric Power Attack (dated 2016), 2015 Ukraine Electric Power Attack (dated 2015) fall before the 2018 window)Lateral Tool Transfer detection strategy DET0183
MITRE names one behaviour worth catching for this technique and breaks it into 4 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detection Strategy for Lateral Tool Transfer across OS platforms
4 platforms
AN0516 · Windows
Correlate suspicious file transfers over SMB or Admin$ shares with process creation events (e.g., cmd.exe, powershell.exe, certutil.exe) that do not align with normal administrative behavior. Detect remote file writes followed by execution of transferred binaries.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | WinEventLog:Sysmon | EventCode=1 |
| File CreationDC0039 | WinEventLog:Sysmon | EventCode=11 |
| Network Share AccessDC0102 | WinEventLog:Security | EventCode=5140 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| TimeWindow | Time period between file transfer and execution used to correlate events |
| UserContext | Accounts allowed to perform legitimate administrative transfers |
| FilePathWhitelist | Exclude known legitimate software update directories |
AN0517 · Linux
Monitor scp, rsync, curl, sftp, or ftp processes initiating transfers to internal systems combined with file creation events in unusual directories. Correlate transfer activity with subsequent execution of those binaries.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| File CreationDC0039 | auditd:FILE | create: New file created in system binaries or temp directories |
| Command ExecutionDC0064 | auditd:SYSCALL | execve: Invocation of scp, rsync, curl, or sftp |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| AllowedTools | Define legitimate transfer utilities expected in the environment |
| DestinationDirectories | Restrict to suspicious or non-standard directories for transferred files |
AN0518 · macOS
Detect anomalous use of scp, rsync, curl, or third-party sync apps transferring executables into user directories. Correlate new file creation with immediate execution events.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | macos:unifiedlog | Execution of scp, rsync, curl with remote destination |
| File CreationDC0039 | macos:unifiedlog | File created in ~/Library/LaunchAgents or executable directories |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| SyncApplications | Whitelisted apps like Dropbox or OneDrive if sanctioned |
| EntropyThreshold | Adjust threshold for unusual filenames/hashes transferred internally |
AN0519 · ESXi
Identify lateral transfer via datastore file uploads or internal scp/ssh sessions that result in new VMX/VMDK or script files. Correlate transfer with VM execution or datastore modification.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| File MetadataDC0059 | esxi:vmkernel | Upload of file to datastore |
| Command ExecutionDC0064 | esxi:hostd | scp/ssh used to move file across hosts |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| DatastoreWhitelist | Known authorized paths for legitimate VM operations |
| TransferProtocol | Protocols allowed for intra-VM host transfers |
3 analytics
As described in CAR-2013-01-003, SMB provides a means of remotely managing a file system. Adversaries often use SMB to move laterally to a host. SMB is commonly used to upload files. It may be used for staging in Exfiltration or as a Lateral Movement technique. Unlike SMB Reads, SMB Write requests typically require an additional level of access, resulting in less activity. Focusing on SMB Write activity narrows the field to find techniques that actively change remote hosts, instead of passively reading files.
D3FEND techniques
The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.
| ID | Name |
|---|---|
| D3-IPCTA | IPC Traffic Analysis |
Data model references
The CAR data model objects, actions and fields the logic reads. Map these to your own schema before implementing.
| Object | Action | Field |
|---|---|---|
| flow | message | proto_info |
| flow | message | dest_port |
Implementations
Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.
flow = search Flow:Message smb_write = filter flow where (dest_port == "445" and protocol == "smb.write") smb_write.file_name = smb_write.proto_info.file_name output smb_write
An adversary needs to gain access to other hosts to move throughout an environment. In many cases, this is a twofold process. First, a file is remotely written to a host via an SMB share (detected by CAR-2013-05-003). Then, a variety of Execution techniques can be used to remotely establish execution of the file or script. To detect this behavior, look for files that are written to a host over SMB and then later run directly as a process or in the command line arguments. SMB File Writes and Remote Execution may happen normally in an environment, but the combination of the two behaviors is less frequent and more likely to indicate adversarial activity.
D3FEND techniques
The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.
| ID | Name |
|---|---|
| D3-IPCTA | IPC Traffic Analysis |
Data model references
The CAR data model objects, actions and fields the logic reads. Map these to your own schema before implementing.
| Object | Action | Field |
|---|---|---|
| process | create | image_path |
| process | create | proto_info |
| process | create | hostname |
Implementations
Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.
process = search Process:Create smb_write = run Analytic:CAR-2013-05-003 remote_start = join (smb_write, process) where ( smb_write.hostname == process.hostname and smb_write.file_path == process.image_path (smb_write.time < process.time) ) output remote_start
An SMB write can be an indicator of lateral movement, especially when combined with other information such as execution of that written file. Named pipes are a subset of SMB write requests. Named pipes such as msftewds may not be alarming; however others, such as lsarpc, may.
D3FEND techniques
The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.
| ID | Name |
|---|---|
| D3-IPCTA | IPC Traffic Analysis |
Data model references
The CAR data model objects, actions and fields the logic reads. Map these to your own schema before implementing.
| Object | Action | Field |
|---|---|---|
| flow | message | proto_info |
| flow | start | dest_port |
Implementations
Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.
Look for SMB network connections over port 445. Using a sensor that can decode protocol information, extract out the name of the pipe and potentially other information. This happens legitimately so certain pipes, such as spoolss should be appropriately white-listed. Certain pipes do correspond to adversary activity, including:
* WINREG - Windows Remote Registry (CAR-2014-11-005)
* ATSVC - Windows AT command (CAR-2015-04-001)
flow = search Flow:Message smb_write = filter flow where (dest_port == "445" and protocol == "smb.write_pipe") smb_write.pipe_name = smb_write.proto_info.pipe_name output smb_write
Consider using the host firewall to restrict file sharing communications such as SMB.
Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware or unusual data transfer over known tools and protocols like FTP can be used to mitigate activity at the network level. Signatures are often for unique indicators within protocols and may be based on the specific obfuscation technique used by a particular adversary or tool, and will likely be different across various malware families and versions.
Tests2ExecutorsPowerShell 2Need elevation2 of 2Have prerequisites0Have cleanup0Platformswindows
Tests from Atomic Red Team (MIT licence) · technique definition