Adversaries may transfer tools or other files between systems in a compromised environment. Once brought into the victim environment (i.e., Ingress Tool Transfer) files may then be copied from one system to another to stage adversary tools or other files over the course of an operation.
Adversaries may copy files between internal victim systems to support lateral movement using inherent file sharing protocols such as file sharing over SMB/Windows Admin Shares to connected network shares or with authenticated connections via Remote Desktop Protocol.[1]
Files can also be transferred using native or otherwise present tools on the victim system, such as scp, rsync, curl, sftp, and ftp. In some cases, adversaries may be able to leverage Web Services such as Dropbox or OneDrive to copy files from one machine to another via shared, automatically synced folders.[2]
ID | Name | Description |
---|---|---|
C0028 | 2015 Ukraine Electric Power Attack |
During the 2015 Ukraine Electric Power Attack, Sandworm Team moved their tools laterally within the corporate network and between the ICS and corporate network. [3] |
C0025 | 2016 Ukraine Electric Power Attack |
During the 2016 Ukraine Electric Power Attack, Sandworm Team used |
C0034 | 2022 Ukraine Electric Power Attack |
During the 2022 Ukraine Electric Power Attack, Sandworm Team used a Group Policy Object (GPO) to copy CaddyWiper's executable |
G1007 | Aoqin Dragon |
Aoqin Dragon has spread malware in target networks by copying modules to folders masquerading as removable devices.[6] |
G0050 | APT32 |
APT32 has deployed tools after moving laterally using administrative accounts.[7] |
G0096 | APT41 |
APT41 uses remote shares to move and remotely execute payloads during lateral movemement.[8] |
S0190 | BITSAdmin |
BITSAdmin can be used to create BITS Jobs to upload and/or download files from SMB file servers.[9] |
S1068 | BlackCat |
BlackCat can replicate itself across connected servers via |
C0015 | C0015 |
During C0015, the threat actors used WMI to load Cobalt Strike onto additional hosts within a compromised network.[11] |
C0018 | C0018 |
During C0018, the threat actors transferred the SoftPerfect Network Scanner and other tools to machines in the network using AnyDesk and PDQ Deploy.[12][13] |
G0114 | Chimera |
Chimera has copied tools between compromised hosts using SMB.[14] |
S0106 | cmd |
cmd can be used to copy files to/from a remotely connected internal system.[15] |
S0062 | DustySky |
DustySky searches for network drives and removable media and duplicates itself onto them.[16] |
S0367 | Emotet |
Emotet has copied itself to remote systems using the |
S0404 | esentutl |
esentutl can be used to copy files to/from a remote share.[18] |
S0361 | Expand |
Expand can be used to download or upload a file over a network share.[19] |
G0051 | FIN10 |
FIN10 has deployed Meterpreter stagers and SplinterRAT instances in the victim network after moving laterally.[20] |
S0095 | ftp |
ftp may be abused by adversaries to transfer tools or files between systems within a compromised environment.[21][22] |
G0093 | GALLIUM |
GALLIUM has used PsExec to move laterally between hosts in the target network.[23] |
S0698 | HermeticWizard |
HermeticWizard can copy files to other machines on a compromised network.[24] |
S0372 | LockerGoga |
LockerGoga has been observed moving around the victim network via SMB, indicating the actors behind this ransomware are manually copying files form computer to computer instead of self-propagating.[1] |
S0532 | Lucifer |
Lucifer can use certutil for propagation on Windows hosts within intranets.[25] |
G0059 | Magic Hound |
Magic Hound has copied tools within a compromised network using RDP.[26] |
S0457 | Netwalker |
Operators deploying Netwalker have used psexec to copy the Netwalker payload across accessible systems.[27] |
S0365 | Olympic Destroyer |
Olympic Destroyer attempts to copy itself to remote machines on the network.[28] |
C0014 | Operation Wocao |
During Operation Wocao, threat actors used SMB to copy files to and from target systems.[29] |
S0029 | PsExec |
PsExec can be used to download or upload a file over a network share.[30] |
G0034 | Sandworm Team |
Sandworm Team has used |
S0140 | Shamoon |
Shamoon attempts to copy itself to remote machines on the network.[32] |
S0603 | Stuxnet |
Stuxnet uses an RPC server that contains a file dropping routine and support for payload version updates for P2P communications within a victim network.[33] |
G0010 | Turla |
Turla RPC backdoors can be used to transfer files to/from victim machines on the local network.[34][35] |
G1017 | Volt Typhoon |
Volt Typhoon has copied web shells between servers in targeted environments.[36] |
S0366 | WannaCry |
WannaCry attempts to copy itself to remote computers after gaining access via an SMB exploit.[37] |
G0102 | Wizard Spider |
Wizard Spider has used stolen credentials to copy tools into the |
ID | Mitigation | Description |
---|---|---|
M1037 | Filter Network Traffic |
Consider using the host firewall to restrict file sharing communications such as SMB. [39] |
M1031 | Network Intrusion Prevention |
Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware or unusual data transfer over known tools and protocols like FTP can be used to mitigate activity at the network level. Signatures are often for unique indicators within protocols and may be based on the specific obfuscation technique used by a particular adversary or tool, and will likely be different across various malware families and versions. [40] |
ID | Data Source | Data Component | Detects |
---|---|---|---|
DS0017 | Command | Command Execution |
Monitor executed commands and arguments for actions for abnormal usage of utilities and command-line arguments that may be used in support of remote transfer of files |
DS0022 | File | File Creation |
Monitor newly constructed files to/from a lateral tool transfer |
File Metadata |
Monitor for alike file hashes or characteristics (ex: filename) that are created on multiple hosts. |
||
DS0023 | Named Pipe | Named Pipe Metadata |
Monitor for contextual data about named pipes on the system. |
DS0033 | Network Share | Network Share Access |
Monitor for unexpected network share access, such as files transferred between shares within a network using protocols such as SMB. |
DS0029 | Network Traffic | Network Traffic Content |
Monitor for unusual processes with internal network connections creating files on-system may be suspicious Note: Analytic Event Type is for Zeek but can also be implemented in other Network Analysis Frameworks by parsing & decoding captured SMB2 network traffic. From a network traffic capture standpoint, it’s important to capture the right traffic for this type of detection to function (e.g., all endpoint to endpoint if possible or workstation to server and workstation to workstation). As such, it is helpful to have a centralized server area where it is possible to monitor communications between servers and endpoints. |
Network Traffic Flow |
Monitor for network traffic originating from unknown/unexpected hardware devices. Local network traffic metadata (such as source MAC addressing) as well as usage of network management protocols such as DHCP may be helpful in identifying hardware. |
||
DS0009 | Process | Process Creation |
Monitor newly constructed processes that assist in lateral tool transfers. |