Lateral Tool Transfer

Adversaries may transfer tools or other files between systems in a compromised environment. Once brought into the victim environment (i.e. Ingress Tool Transfer) files may then be copied from one system to another to stage adversary tools or other files over the course of an operation. Adversaries may copy files between internal victim systems to support lateral movement using inherent file sharing protocols such as file sharing over SMB/Windows Admin Shares to connected network shares or with authenticated connections via Remote Desktop Protocol.[1]

Files can also be transferred using native or otherwise present tools on the victim system, such as scp, rsync, curl, sftp, and ftp.

ID: T1570
Sub-techniques:  No sub-techniques
Platforms: Linux, Windows, macOS
Version: 1.2
Created: 11 March 2020
Last Modified: 19 April 2022

Procedure Examples

ID Name Description
G0050 APT32

APT32 has deployed tools after moving laterally using administrative accounts.[2]

S0190 BITSAdmin

BITSAdmin can be used to create BITS Jobs to upload and/or download files from SMB file servers.[3]

G0114 Chimera

Chimera has copied tools between compromised hosts using SMB.[4]

S0106 cmd

cmd can be used to copy files to/from a remotely connected internal system.[5]

S0062 DustySky

DustySky searches for network drives and removable media and duplicates itself onto them.[6]

S0404 esentutl

esentutl can be used to copy files to/from a remote share.[7]

S0361 Expand

Expand can be used to download or upload a file over a network share.[8]

G0051 FIN10

FIN10 has deployed Meterpreter stagers and SplinterRAT instances in the victim network after moving laterally.[9]

S0095 ftp

ftp may be abused by adversaries to transfer tools or files between systems within a compromised environment.[10][11]

G0093 GALLIUM

GALLIUM has used PsExec to move laterally between hosts in the target network.[12]

S0698 HermeticWizard

HermeticWizard can copy files to other machines on a compromised network.[13]

S0372 LockerGoga

LockerGoga has been observed moving around the victim network via SMB, indicating the actors behind this ransomware are manually copying files form computer to computer instead of self-propagating.[1]

S0532 Lucifer

Lucifer can use certutil for propagation on Windows hosts within intranets.[14]

S0457 Netwalker

Operators deploying Netwalker have used psexec to copy the Netwalker payload across accessible systems.[15]

S0365 Olympic Destroyer

Olympic Destroyer attempts to copy itself to remote machines on the network.[16]

G0116 Operation Wocao

Operation Wocao has used SMB to copy files to and from target systems.[17]

S0029 PsExec

PsExec can be used to download or upload a file over a network share.[18]

G0034 Sandworm Team

Sandworm Team has used move to transfer files to a network share.[19]

S0140 Shamoon

Shamoon attempts to copy itself to remote machines on the network.[20]

S0603 Stuxnet

Stuxnet uses an RPC server that contains a file dropping routine and support for payload version updates for P2P communications within a victim network.[21]

G0010 Turla

Turla RPC backdoors can be used to transfer files to/from victim machines on the local network.[22][23]

S0366 WannaCry

WannaCry attempts to copy itself to remote computers after gaining access via an SMB exploit.[24]

G0102 Wizard Spider

Wizard Spider has used stolen credentials to copy tools into the %TEMP% directory of domain controllers.[25]

Mitigations

ID Mitigation Description
M1037 Filter Network Traffic

Consider using the host firewall to restrict file sharing communications such as SMB. [26]

M1031 Network Intrusion Prevention

Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware or unusual data transfer over known tools and protocols like FTP can be used to mitigate activity at the network level. Signatures are often for unique indicators within protocols and may be based on the specific obfuscation technique used by a particular adversary or tool, and will likely be different across various malware families and versions. [27]

Detection

ID Data Source Data Component Detects
DS0017 Command Command Execution

Monitor executed commands and arguments for actions for abnormal usage of utilities and command-line arguments that may be used in support of remote transfer of files

DS0022 File File Creation

Monitor newly constructed files to/from a lateral tool transfer

File Metadata

Monitor for alike file hashes or characteristics (ex: filename) that are created on multiple hosts.

DS0023 Named Pipe Named Pipe Metadata

Monitor for contextual data about named pipes on the system.

DS0033 Network Share Network Share Access

Monitor for unexpected network share access, such as files transferred between shares within a network using protocols such as SMB.

DS0029 Network Traffic Network Traffic Content

Monitor for unusual processes with internal network connections creating files on-system may be suspicious

Network Traffic Flow

Monitor for network traffic originating from unknown/unexpected hardware devices. Local network traffic metadata (such as source MAC addressing) as well as usage of network management protocols such as DHCP may be helpful in identifying hardware.

DS0009 Process Process Creation

Monitor newly constructed processes that assist in lateral tool transfers.

References

  1. Szappanos, G., Brandt, A.. (2020, May 27). Netwalker ransomware tools give insight into threat actor. Retrieved May 27, 2020.
  2. Mercer, W. and Rascagneres, P. (2018, February 12). Olympic Destroyer Takes Aim At Winter Olympics. Retrieved March 14, 2019.
  3. Dantzig, M. v., Schamper, E. (2019, December 19). Operation Wocao: Shining a light on one of China’s hidden hacking groups. Retrieved October 8, 2020.
  4. Russinovich, M. (2004, June 28). PsExec. Retrieved December 17, 2015.
  5. Joe Slowik. (2018, October 12). Anatomy of an Attack: Detecting and Defeating CRASHOVERRIDE. Retrieved December 18, 2020.
  6. Falcone, R.. (2016, November 30). Shamoon 2: Return of the Disttrack Wiper. Retrieved January 11, 2017.
  7. Nicolas Falliere, Liam O. Murchu, Eric Chien. (2011, February). W32.Stuxnet Dossier. Retrieved December 7, 2020.
  8. Faou, M. and Dumont R.. (2019, May 29). A dive into Turla PowerShell usage. Retrieved June 14, 2019.
  9. Symantec DeepSight Adversary Intelligence Team. (2019, June 20). Waterbug: Espionage Group Rolls Out Brand-New Toolset in Attacks Against Governments. Retrieved July 8, 2019.
  10. Noerenberg, E., Costis, A., and Quist, N. (2017, May 16). A Technical Analysis of WannaCry Ransomware. Retrieved March 25, 2019.
  11. John, E. and Carvey, H. (2019, May 30). Unraveling the Spiderweb: Timelining ATT&CK Artifacts Used by GRIM SPIDER. Retrieved May 12, 2020.
  12. Microsoft. (2020, March 10). Preventing SMB traffic from lateral connections and entering or leaving the network. Retrieved June 1, 2020.
  13. Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.