T1570 — Lateral Tool Transfer

Tactic: Lateral Movement · Platforms: ESXi, Linux, macOS, Windows

Adversaries may transfer tools or other files between systems in a compromised environment. Once brought into the victim environment (i.e., Ingress Tool Transfer) files may then be copied from one system to another to stage adversary tools or other files over the course of an operation.…

Sigma detection rules (4)

T1570 Lateral Tool Transfer

title: T1570 Lateral Tool Transfer
id: c4ed7bae-1bfc-4c62-84ce-35728a643aa0
description: 'Detection Strategy for Lateral Tool Transfer across OS platforms. (Retargeted from the original process_creation label to file_event — this is the telemetry source that actually captures this technique''s behavior; see logsource below.) Tune using: TimeWindow, UserContext, FilePathWhitelist.'
references:
  - https://attack.mitre.org/techniques/T1570
author: Shahrukh Khan
date: 2026-04-05
license: MIT
tags:
  - attack.lateral-movement
  - attack.t1570

logsource:
  category: file_event
  product: windows
  service: sysmon

detection:
  selection:
    TargetFilename|contains: '\ADMIN$\'
    TargetFilename|endswith:
      - '.exe'
      - '.dll'
      - '.bat'
      - '.ps1'
      - '.vbs'
      - '.scr'
      - '.jar'
      - '.cmd'

  condition: selection

falsepositives:
  - Legitimate software-deployment tools (SCCM, PDQ Deploy, BigFix, Altiris) staging executable/script packages via administrative shares.

level: medium

T1570 Lateral Tool Transfer

title: T1570 Lateral Tool Transfer
id: 749afb05-2fc2-4ba1-9a4d-a86c85d1ebb1
description: 'Detection Strategy for Lateral Tool Transfer across OS platforms, requiring both a tmp-directory destination and an explicit remote host specifier (user@host: or host:path) in the scp/rsync/sftp arguments to distinguish genuine cross-host transfer from a purely local copy. (Retargeted to the process_creation auditd telemetry that actually captures this techniques behavior; see logsource below.) Tune using: AllowedTools, DestinationDirectories.'
references:
  - https://attack.mitre.org/techniques/T1570
author: Shahrukh Khan
date: 2026-02-12
license: MIT
tags:
  - attack.lateral-movement
  - attack.t1570

logsource:
  category: process_creation
  product: linux

detection:
  selection:
    type: EXECVE
    a0|endswith:
      - '/scp'
      - '/rsync'
      - '/sftp'
  selection_dest:
    a1|contains:
      - '/tmp/'
      - '/var/tmp/'
      - '/dev/shm/'
  selection_remote:
    - a1|re: '^([\w.-]+@)?[\w.-]+:'
    - a2|re: '^([\w.-]+@)?[\w.-]+:'
    - a3|re: '^([\w.-]+@)?[\w.-]+:'

  condition: selection and selection_dest and selection_remote

falsepositives:
  - Routine file staging by deployment/config-management tools (Ansible, Chef) using scp/rsync to copy into standard tmp directories on remote managed hosts.

level: high

T1570 Lateral Tool Transfer

title: T1570 Lateral Tool Transfer
id: 7bfb13ca-fa1b-43c6-97d9-22863eb6145b
description: 'Detection Strategy for Lateral Tool Transfer across OS platforms. (Retargeted to the file_event macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: SyncApplications, EntropyThreshold.'
references:
  - https://attack.mitre.org/techniques/T1570
author: Shahrukh Khan
date: 2026-01-26
license: MIT
tags:
  - attack.lateral-movement
  - attack.t1570

logsource:
  category: file_event
  product: macos

detection:
  selection:
    TargetFilename|contains:
      - '/Library/Application Support/Dropbox/'
      - '/Library/CloudStorage/'
    TargetFilename|endswith:
      - '.sh'
      - '.py'
      - '.pkg'

  condition: selection

falsepositives:
  - Users legitimately syncing scripts or installer packages through Dropbox or iCloud as part of normal file sharing workflows.

level: medium

T1570 Lateral Tool Transfer

title: T1570 Lateral Tool Transfer
id: b707259c-a0f9-4e25-8f04-6fbc1f1a2ab0
description: 'Detection Strategy for Lateral Tool Transfer across OS platforms. (Retargeted to the process_creation ESXi telemetry that actually captures this techniques behavior; see logsource below.) Tune using: DatastoreWhitelist, TransferProtocol.'
references:
  - https://attack.mitre.org/techniques/T1570
author: Shahrukh Khan
date: 2026-02-28
license: MIT
tags:
  - attack.lateral-movement
  - attack.t1570

logsource:
  product: esxi
  service: shell

detection:
  selection_tool:
    CommandLine|contains:
      - 'scp '
      - 'vifs '
  selection_dest:
    CommandLine|contains: '/vmfs/volumes/'

  condition: selection_tool and selection_dest

falsepositives:
  - Legitimate administrator or automation copying tools, scripts, or images between hosts and datastores that are on the DatastoreWhitelist as part of routine operations.

level: high

Explore