Adversaries may transfer tools or other files between systems in a compromised environment. Once brought into the victim environment (i.e. Ingress Tool Transfer) files may then be copied from one system to another to stage adversary tools or other files over the course of an operation. Adversaries may copy files between internal victim systems to support lateral movement using inherent file sharing protocols such as file sharing over SMB/Windows Admin Shares to connected network shares or with authenticated connections via Remote Desktop Protocol.(Citation: Unit42 LockerGoga 2019)
Files can also be transferred using native or otherwise present tools on the victim system, such as scp, rsync, curl, sftp, and ftp.
View in MITRE ATT&CK®| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name |
|---|---|---|---|---|
| AC-3 | Access Enforcement | Protects | T1570 | Lateral Tool Transfer |
| AC-4 | Information Flow Enforcement | Protects | T1570 | Lateral Tool Transfer |
| CA-7 | Continuous Monitoring | Protects | T1570 | Lateral Tool Transfer |
| CM-2 | Baseline Configuration | Protects | T1570 | Lateral Tool Transfer |
| CM-6 | Configuration Settings | Protects | T1570 | Lateral Tool Transfer |
| CM-7 | Least Functionality | Protects | T1570 | Lateral Tool Transfer |
| SC-7 | Boundary Protection | Protects | T1570 | Lateral Tool Transfer |
| SI-10 | Information Input Validation | Protects | T1570 | Lateral Tool Transfer |
| SI-15 | Information Output Filtering | Protects | T1570 | Lateral Tool Transfer |
| SI-3 | Malicious Code Protection | Protects | T1570 | Lateral Tool Transfer |
| SI-4 | System Monitoring | Protects | T1570 | Lateral Tool Transfer |
| action.malware.vector.Network propagation | Network propagation | related-to | T1570 | Lateral Tool Transfer |