T1570 Lateral Tool Transfer — Detection Rules

Source-backed rule directory

• Metasploit Or Impacket Service Installation Via SMB PsExec · test · high · {"product":"windows","service":"security","definition":"The 'System Security Extension' audit subcategory need to be enabled to log the EID 4697"}
• Potentially Suspicious File Creation by OpenEDR's ITSMService · experimental · medium · {"product":"windows","category":"file_event"}
• PSEXEC Remote Execution File Artefact · test · high · {"category":"file_event","product":"windows"}
• Rundll32 Execution Without Parameters · test · high · {"category":"process_creation","product":"windows"}

Atlas deterministic concepts

T1570 Lateral Tool Transfer

MATCH(file_written_to_remote_share_or_host) AND file_hash_or_extension IN monitored_types -> ALERT

• File-System Activity Logs
• File Transfer Service Logs
• Network Flow Logs
• Atlas source section

Anomaly models

ATT&CK analytic guidance

DET0183 Detection Strategy for Lateral Tool Transfer across OS platforms

AN0516 Analytic 0516

Correlate suspicious file transfers over SMB or Admin$ shares with process creation events (e.g., cmd.exe, powershell.exe, certutil.exe) that do not align with normal administrative behavior. Detect remote file writes followed by execution of transferred binaries.

AN0517 Analytic 0517

Monitor scp, rsync, curl, sftp, or ftp processes initiating transfers to internal systems combined with file creation events in unusual directories. Correlate transfer activity with subsequent execution of those binaries.

AN0518 Analytic 0518

Detect anomalous use of scp, rsync, curl, or third-party sync apps transferring executables into user directories. Correlate new file creation with immediate execution events.

AN0519 Analytic 0519

Identify lateral transfer via datastore file uploads or internal scp/ssh sessions that result in new VMX/VMDK or script files. Correlate transfer with VM execution or datastore modification.