T1570Lateral Movement
Lateral Tool Transfer
Adversaries may transfer tools or other files between systems in a compromised environment. Once brought into the victim environment (i.e., Ingress Tool Transfer) files may then be copied from one system to another to stage adversary tools or other files over the course of an operation. Adversaries may copy files between internal victim systems to support lateral movement using inherent file…
CVEs1
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.1
Reports0
Detections
6 Sigma rules tagged T1570Lateral Tool TransferT15706 general rules
- Metasploit Or Impacket Service Installation Via SMB PsExechightest
- PSEXEC Remote Execution File Artefacthightest
- Rundll32 Execution Without Parametershightest
- SMB over QUIC Via Net.EXEmediumtest
- SMB over QUIC Via PowerShell Scriptmediumtest
- Potentially Suspicious File Creation by OpenEDR's ITSMServicemediumexperimental
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Lateral Tool Transfer
1 CVE, by priority. Each link shows its badge.- CVE-2024-4577PHP-CGI OS Command Injection VulnerabilityPHP Group · PHPKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter+10 moreMITRE CTID mapping of the KEV entry · follow-on activity>99.9%Top 0.02%79.9priority