Lateral Tool Transfer

Adversaries may transfer tools or other files from one system to another to stage adversary tools or other files over the course of an operation. [1] Copying of files may also be performed laterally between internal victim systems to support Lateral Movement with remote Execution using inherent file sharing protocols such as file sharing over SMB to connected network shares. [1]

In control systems environments, malware may use SMB and other file sharing protocols to move laterally through industrial networks.

ID: T0867
Sub-techniques:  No sub-techniques
Platforms: None
Version: 1.1
Created: 21 May 2020
Last Modified: 13 October 2023

Procedure Examples

ID Name Description
C0028 2015 Ukraine Electric Power Attack

During the 2015 Ukraine Electric Power Attack, Sandworm Team moved their tools laterally within the ICS network. [2]

C0025 2016 Ukraine Electric Power Attack

During the 2016 Ukraine Electric Power Attack, Sandworm Team used a VBS script to facilitate lateral tool transfer. The VBS script was used to copy ICS-specific payloads with the following command: cscript C:\Backinfo\ufn.vbs C:\Backinfo\101.dll C:\Delta\101.dll[3]

S0606 Bad Rabbit

Bad Rabbit can move laterally through industrial networks by means of the SMB service. [4]

S1045 INCONTROLLER

INCONTROLLER can use a Telnet session to load a malware implant on Omron PLCs.[5][6]

S0368 NotPetya

NotPetya can move laterally through industrial networks by means of the SMB service. [4]

S0603 Stuxnet

Stuxnet sends an SQL statement that creates a table and inserts a binary value into the table. The binary value is a hex string representation of the main Stuxnet DLL as an executable file (formed using resource 210) and an updated configuration data block. [7]

S0366 WannaCry

WannaCry can move laterally through industrial networks by means of the SMB service. [4]

Targeted Assets

ID Asset
A0008 Application Server
A0007 Control Server
A0013 Field I/O
A0012 Jump Host
A0011 Virtual Private Network (VPN) Server
A0001 Workstation

Mitigations

ID Mitigation Description
M0931 Network Intrusion Prevention

Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware or unusual data transfer over known tools and protocols like FTP can be used to mitigate activity at the network level. Signatures are often for unique indicators within protocols and may be based on the specific obfuscation technique used by a particular adversary or tool and will likely be different across various malware families and versions. Adversaries will likely change tool C2 signatures over time or construct protocols in such a way as to avoid detection by common defensive tools. [8]

Detection

ID Data Source Data Component Detects
DS0017 Command Command Execution

Monitor executed commands and arguments for abnormal usage of utilities and command-line arguments that may be used in support of remote transfer of files.

DS0022 File File Creation

Monitor for file creation in conjunction with other techniques (e.g., file transfers using Remote Services).

File Metadata

Monitor for alike file hashes or characteristics (ex: filename) that are created on multiple hosts.

DS0033 Network Share Network Share Access

Monitor for unexpected network share access, such as files transferred between shares within a network using protocols such as Server Message Block (SMB).

DS0029 Network Traffic Network Traffic Content

Monitor for unusual processes with internal network connections creating files on-system which may be suspicious.

Network Traffic Flow

Monitor for network traffic originating from unknown/unexpected hosts. Local network traffic metadata (such as source MAC addressing) as well as usage of network management protocols such as DHCP may be helpful in identifying hardware.

DS0009 Process Process Creation

Monitor newly constructed processes that assist in lateral tool transfers, such as file transfer programs.

References