Adversaries may transfer tools or other files between systems in a compromised environment. Once brought into the victim environment (i.e. Ingress Tool Transfer) files may then be copied from one system to another to stage adversary tools or other files over the course of an operation. Adversaries may copy files between internal victim systems to support lateral movement using inherent file sharing protocols such as file sharing over SMB/Windows Admin Shares to connected network shares or with authenticated connections via Remote Desktop Protocol.
Files can also be transferred using native or otherwise present tools on the victim system, such as scp, rsync, curl, sftp, and ftp.
LockerGoga has been observed moving around the victim network via SMB, indicating the actors behind this ransomware are manually copying files form computer to computer instead of self-propagating.
|M1037||Filter Network Traffic||
Consider using the host firewall to restrict file sharing communications such as SMB. 
|M1031||Network Intrusion Prevention||
Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware or unusual data transfer over known tools and protocols like FTP can be used to mitigate activity at the network level. Signatures are often for unique indicators within protocols and may be based on the specific obfuscation technique used by a particular adversary or tool, and will likely be different across various malware families and versions. 
|ID||Data Source||Data Component||Detects|
Monitor executed commands and arguments for actions for abnormal usage of utilities and command-line arguments that may be used in support of remote transfer of files
Monitor newly constructed files to/from a lateral tool transfer
Monitor for alike file hashes or characteristics (ex: filename) that are created on multiple hosts.
|DS0023||Named Pipe||Named Pipe Metadata||
Monitor for contextual data about named pipes on the system.
|DS0033||Network Share||Network Share Access||
Monitor for unexpected network share access, such as files transferred between shares within a network using protocols such as SMB.
|DS0029||Network Traffic||Network Traffic Content||
Monitor for unusual processes with internal network connections creating files on-system may be suspicious
|Network Traffic Flow||
Monitor for network traffic originating from unknown/unexpected hardware devices. Local network traffic metadata (such as source MAC addressing) as well as usage of network management protocols such as DHCP may be helpful in identifying hardware.
Monitor newly constructed processes that assist in lateral tool transfers.