Куда я попал?

SECURITM это SGRC система, автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.

Подробнее

Lateral Tool Transfer

Adversaries may transfer tools or other files between systems in a compromised environment. Once brought into the victim environment (i.e., Ingress Tool Transfer) files may then be copied from one system to another to stage adversary tools or other files over the course of an operation. Adversaries may copy files between internal victim systems to support lateral movement using inherent file sharing protocols such as file sharing over SMB/Windows Admin Shares to connected network shares or with authenticated connections via Remote Desktop Protocol.(Citation: Unit42 LockerGoga 2019) Files can also be transferred using native or otherwise present tools on the victim system, such as scp, rsync, curl, sftp, and ftp. In some cases, adversaries may be able to leverage Web Services such as Dropbox or OneDrive to copy files from one machine to another via shared, automatically synced folders.(Citation: Dropbox Malware Sync)

ID: T1570

Tactic(s): Lateral Movement

Platforms: ESXi, Linux, Windows, macOS

Data Sources: Command: Command Execution, File: File Creation, File: File Metadata, Named Pipe: Named Pipe Metadata, Network Share: Network Share Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation

Version: 1.4

Created: 11 Mar 2020

Last Modified: 15 Apr 2025

Name	Description
Procedure Examples
Stuxnet	Stuxnet uses an RPC server that contains a file dropping routine and support for payload version updates for P2P communications within a victim network.(Citation: Nicolas Falliere, Liam O Murchu, Eric Chien February 2011)
Impacket	Impacket has used its `wmiexec` command, leveraging Windows Management Instrumentation, to remotely stage and execute payloads in victim networks.(Citation: Sygnia VelvetAnt 2024A)
Emotet	Emotet has copied itself to remote systems using the `service.exe` filename.(Citation: Binary Defense Emotes Wi-Fi Spreader)
Olympic Destroyer	Olympic Destroyer attempts to copy itself to remote machines on the network.(Citation: Talos Olympic Destroyer 2018)
BlackCat	BlackCat can replicate itself across connected servers via `psexec`.(Citation: Microsoft BlackCat Jun 2022)
Lucifer	Lucifer can use certutil for propagation on Windows hosts within intranets.(Citation: Unit 42 Lucifer June 2020)
LockerGoga	LockerGoga has been observed moving around the victim network via SMB, indicating the actors behind this ransomware are manually copying files form computer to computer instead of self-propagating.(Citation: Unit42 LockerGoga 2019)
BITSAdmin	BITSAdmin can be used to create BITS Jobs to upload and/or download files from SMB file servers.(Citation: Microsoft About BITS)
DustySky	DustySky searches for network drives and removable media and duplicates itself onto them.(Citation: DustySky)
Netwalker	Operators deploying Netwalker have used psexec to copy the Netwalker payload across accessible systems.(Citation: Sophos Netwalker May 2020)
WannaCry	WannaCry attempts to copy itself to remote computers after gaining access via an SMB exploit.(Citation: LogRhythm WannaCry)
Shamoon	Shamoon attempts to copy itself to remote machines on the network.(Citation: Palo Alto Shamoon Nov 2016)
Kerrdown	Kerrdown can download additional software including Cobalt Strike from servers on the victim's network.(Citation: Amnesty Intl. Ocean Lotus February 2021)
BlackByte Ransomware	BlackByte Ransomware spreads itself laterally by writing the JavaScript launcher file to mapped shared folders.(Citation: Trustwave BlackByte 2021)
IPsec Helper	IPsec Helper can download additional payloads from command and control nodes and execute them.(Citation: SentinelOne Agrius 2021)
cmd	cmd can be used to copy files to/from a remotely connected internal system.(Citation: TechNet Copy)
OutSteel	OutSteel can download the Saint Bot malware for follow-on execution.(Citation: Palo Alto Unit 42 OutSteel SaintBot February 2022 )
esentutl	esentutl can be used to copy files to/from a remote share.(Citation: LOLBAS Esentutl)
Expand	Expand can be used to download or upload a file over a network share.(Citation: LOLBAS Expand)
ftp	ftp may be abused by adversaries to transfer tools or files between systems within a compromised environment.(Citation: Microsoft FTP)(Citation: Linux FTP)
INC Ransomware	INC Ransomware can push its encryption executable to multiple endpoints within compromised infrastructure.(Citation: Huntress INC Ransom Group August 2023)
PsExec	PsExec can be used to download or upload a file over a network share.(Citation: PsExec Russinovich)
HermeticWizard	HermeticWizard can copy files to other machines on a compromised network.(Citation: ESET Hermetic Wizard March 2022)
Turla	Turla RPC backdoors can be used to transfer files to/from victim machines on the local network.(Citation: ESET Turla PowerShell May 2019)(Citation: Symantec Waterbug Jun 2019)
Operation Wocao	Operation Wocao has used SMB to copy files to and from target systems.(Citation: FoxIT Wocao December 2019)
BlackByte	BlackByte transfered tools such as Cobalt Strike and the AnyDesk remote access tool during operations using SMB shares.(Citation: Picus BlackByte 2022)
Wizard Spider	Wizard Spider has used stolen credentials to copy tools into the `%TEMP%` directory of domain controllers.(Citation: CrowdStrike Grim Spider May 2019)
APT32	APT32 has deployed tools after moving laterally using administrative accounts.(Citation: Cybereason Cobalt Kitty 2017)
INC Ransom	INC Ransom has used a rapid succession of copy commands to install a file encryption executable across multiple endpoints within compromised infrastructure.(Citation: Huntress INC Ransom Group August 2023)(Citation: Secureworks GOLD IONIC April 2024)
Chimera	Chimera has copied tools between compromised hosts using SMB.(Citation: NCC Group Chimera January 2021)
Volt Typhoon	Volt Typhoon has copied web shells between servers in targeted environments.(Citation: Secureworks BRONZE SILHOUETTE May 2023)
Sandworm Team	Sandworm Team has used `move` to transfer files to a network share and has copied payloads--such as Prestige ransomware--to an Active Directory Domain Controller and distributed via the Default Domain Group Policy Object.(Citation: Dragos Crashoverride 2018)(Citation: Microsoft Prestige ransomware October 2022) Additionally, Sandworm Team has transferred an ISO file into the OT network to gain initial access.(Citation: Mandiant-Sandworm-Ukraine-2022)
Velvet Ant	Velvet Ant transferred files laterally within victim networks through the Impacket toolkit.(Citation: Sygnia VelvetAnt 2024A)
Magic Hound	Magic Hound has copied tools within a compromised network using RDP.(Citation: DFIR Phosphorus November 2021)
Aoqin Dragon	Aoqin Dragon has spread malware in target networks by copying modules to folders masquerading as removable devices.(Citation: SentinelOne Aoqin Dragon June 2022)
Storm-1811	Storm-1811 has used the Impacket toolset to move and remotely execute payloads to other hosts in victim networks.(Citation: rapid7-email-bombing)
Ember Bear	Ember Bear retrieves follow-on payloads direct from adversary-owned infrastructure for deployment on compromised hosts.(Citation: Cadet Blizzard emerges as novel threat actor)
FIN10	FIN10 has deployed Meterpreter stagers and SplinterRAT instances in the victim network after moving laterally.(Citation: FireEye FIN10 June 2017)
Agrius	Agrius downloaded some payloads for follow-on execution from legitimate filesharing services such as `ufile.io` and `easyupload.io`.(Citation: CheckPoint Agrius 2023)
GALLIUM	GALLIUM has used PsExec to move laterally between hosts in the target network.(Citation: Microsoft GALLIUM December 2019)
APT41	APT41 uses remote shares to move and remotely execute payloads during lateral movemement.(Citation: Rostovcev APT41 2021)

Mitigation	Description
Mitigations
Filter Network Traffic	Employ network appliances and endpoint software to filter ingress, egress, and lateral network traffic. This includes protocol-based filtering, enforcing firewall rules, and blocking or restricting traffic based on predefined conditions to limit adversary movement and data exfiltration. This mitigation can be implemented through the following measures: Ingress Traffic Filtering: - Use Case: Configure network firewalls to allow traffic only from authorized IP addresses to public-facing servers. - Implementation: Limit SSH (port 22) and RDP (port 3389) traffic to specific IP ranges. Egress Traffic Filtering: - Use Case: Use firewalls or endpoint security software to block unauthorized outbound traffic to prevent data exfiltration and command-and-control (C2) communications. - Implementation: Block outbound traffic to known malicious IPs or regions where communication is unexpected. Protocol-Based Filtering: - Use Case: Restrict the use of specific protocols that are commonly abused by adversaries, such as SMB, RPC, or Telnet, based on business needs. - Implementation: Disable SMBv1 on endpoints to prevent exploits like EternalBlue. Network Segmentation: - Use Case: Create network segments for critical systems and restrict communication between segments unless explicitly authorized. - Implementation: Implement VLANs to isolate IoT devices or guest networks from core business systems. Application Layer Filtering: - Use Case: Use proxy servers or Web Application Firewalls (WAFs) to inspect and block malicious HTTP/S traffic. - Implementation: Configure a WAF to block SQL injection attempts or other web application exploitation techniques.
Network Intrusion Prevention	Use intrusion detection signatures to block traffic at network boundaries.

Detection

Monitor for file creation and files transferred within a network using protocols such as SMB or FTP. Unusual processes with internal network connections creating files on-system may be suspicious. Consider monitoring for abnormal usage of utilities and command-line arguments that may be used in support of remote transfer of files. Considering monitoring for alike file hashes or characteristics (ex: filename) that are created on multiple hosts.

References

Связанные риски

Риск	Связи
Боковое перемещение злоумышленника по локальной сети из-за возможности передачи утилит и инструментов при боковом перемещении в операционной системе Конфиденциальность Целостность	1

Каталоги

Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.

Lateral Tool Transfer

Procedure Examples

Mitigations

Detection

References

Связанные риски

Каталоги