After an attacker is inside, tools and files have to get from the first machine to the next. MITRE T1570, Lateral Tool Transfer, is that step. It sits under the lateral movement tactic and applies to ESXi, Linux, macOS and Windows.
How attackers use it
Once tools are in the environment, which is Ingress Tool Transfer, files may be copied from one system to another to stage tools or other files over the course of an operation.
MITRE describes several routes:
- Internal copies over standard file sharing protocols, such as SMB shares and Windows Admin Shares, or over authenticated Remote Desktop connections.
- Native tools already on the system, such as
scp,rsync,curl,sftpandftp. - Web services such as Dropbox or OneDrive, using shared, automatically synced folders to carry files from one machine to another.
Because these are the same ways administrators move files, the technique rarely produces a malware-looking event by itself. The giveaway is almost always what happens after the copy.
How to detect it
MITRE's detection strategy correlates transfers with execution of the transferred file.
- Windows: suspicious file transfers over SMB or Admin shares, correlated with process creation such as
cmd.exe,powershell.exeorcertutil.exethat does not match normal administration, and remote file writes followed by execution of the transferred binaries. - Linux:
scp,rsync,curl,sftporftpprocesses sending to internal systems, combined with file creation in unusual directories and later execution of those files. - macOS: unusual use of
scp,rsync,curlor third-party sync apps transferring executables into user directories, with new files executed right away. - ESXi: transfers through datastore file uploads or internal scp and ssh sessions that create new VMX or VMDK files or scripts, correlated with VM execution or datastore changes.
Useful logs:
- Windows file share auditing events, such as 5140 for share access and 5145 for detailed file share checks, if enabled.
- Network logon events on the destination, and process creation events there.
- Linux SSH logs and auditd file creation records.
- Network flow data showing internal SMB or SSH between hosts that do not usually talk.
A good pairing for an alert is a file written remotely to a user or temp directory, and execution of that file within minutes.
How to reduce the risk
MITRE lists two mitigations.
- Filter Network Traffic. Consider using the host firewall to restrict file sharing communications such as SMB.
- Network Intrusion Prevention. Use network detection and prevention with signatures for specific malware or for unusual data transfer over known tools and protocols such as FTP. MITRE notes that signatures are often built around unique indicators within protocols and may be based on a specific obfuscation technique.
The first is the stronger lever. Most workstations do not need to accept inbound SMB from other workstations. A default deny between peer endpoints turns a quiet copy into a blocked connection and an alert.
Try it yourself
Click through it at your own pace, or open it full screen.
Check your own environment
- Can workstation A open an administrative share on workstation B? Test from a controlled host and fix what you find.
- Which hosts are allowed to use SSH and SCP to servers, and from where?
- Do you have a current inventory of systems? You cannot judge a transfer between hosts you do not know about.
- Are file share auditing and SSH logs collected centrally?
Read-only commands. On Windows, current shares and sessions:
Get-SmbShare
Get-SmbSession
On Linux, current SSH connections:
ss -tn state established '( sport = :22 )'
Review who is connected and whether it matches expectations.
Investigating a hit
Work from the destination. Find the file written, the account and source host that wrote it, and whatever executed it. Then look at the source host: how did the file get there, and what else did that account touch? If sync folders are involved, check the cloud account as well, since the same folder may be on other machines. Hash the file and search for it across the fleet.
Reducing false positives
Software distribution systems, backup agents and administrators all move files internally. List the sources that are allowed to push files to many hosts, such as your deployment server, and exclude them narrowly. Everything else that writes executables to user directories deserves attention.
Quick check
Why does this technique need correlation to detect?
The copy itself uses normal admin protocols. The meaningful signal is a remote write followed by execution of the same file.
Which mitigation does MITRE give for SMB?
Use the host firewall to restrict file sharing communications such as SMB.
How can cloud services be used for lateral tool transfer?
Shared, automatically synced folders in services like Dropbox or OneDrive can carry a file from one machine to another.
