1200KM / simulation
Adversaries may transfer tools or other files between systems in a compromised environment. Once brought into the victim environment (i.e., Ingress Tool Transfer) files may then be copied from one system to another to stage adversary tools or other files over the course of an operation. Adversaries may copy files between internal victim systems to support lateral movement using inherent file sharing protocols such as file sharing over…
Adversaries may transfer tools or other files between systems in a compromised environment. Once brought into the victim environment (i.e., Ingress Tool Transfer) files may then be copied from one system to another to stage adversary tools or other files over the course of an operation.
Adversaries may copy files between internal victim systems to support lateral movement using inherent file sharing protocols such as file sharing over SMB/Windows Admin Shares to connected network shares or with authenticated connections via Remote Desktop Protocol.[Unit42 LockerGoga 2019]
Files can also be transferred using native or otherwise present tools on the victim system, such as scp, rsync, curl, sftp, and ftp. In some cases, adversaries may be able to leverage Web Services such as Dropbox or OneDrive to copy files from one machine to another via shared, automatically synced folders.[Dropbox Malware Sync]
Official technique definition · Open in the interactive matrix
These contracts are selected through exact technique-to-data-component relationships or explicitly labelled planning overrides. Configure a collector at the relevant observation point; a telemetry name alone is not coverage.
DC0064 collection page — Collect process command lines and relevant shell/interpreter audit; shell history alone is neither complete nor tamper-resistant.
Required normalized fields: interpreter, command_line, actor_uid, session_id.
Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.
{
"schema": "1200km.telemetry.example.v1",
"synthetic": true,
"timestamp": "2026-09-27T12:00:00Z",
"telemetry_id": "DC0064",
"collector": "illustrative-lab-collector",
"observation": {
"interpreter": "/bin/sh",
"command_line": "printf LAB_TELEMETRY_CHECK",
"actor_uid": 1000,
"session_id": "lab-session-1"
}
}Visibility limits: Script content and process command lines are different signals. Logging may be partial, fragmented, filtered or disabled; never assume a command line reveals everything executed.
DC0039 collection page — Scope Sysmon FileCreate (11) to the lab directory; retain the process and file path. Differentiate creation/overwrite if the sensor can.
Required normalized fields: process_id, path, action, size_bytes.
Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.
{
"schema": "1200km.telemetry.example.v1",
"synthetic": true,
"timestamp": "2026-09-27T12:00:00Z",
"telemetry_id": "DC0039",
"collector": "illustrative-lab-collector",
"observation": {
"process_id": 4200,
"path": "C:\\Lab\\demo.txt",
"action": "create",
"size_bytes": 64
}
}Visibility limits: Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.
DC0059 collection page — Collect scoped file inventory/FIM metadata with hash algorithm and observation time; preserve original timestamps separately from collector time.
Required normalized fields: path, size_bytes, sha256, owner_uid.
Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.
{
"schema": "1200km.telemetry.example.v1",
"synthetic": true,
"timestamp": "2026-09-27T12:00:00Z",
"telemetry_id": "DC0059",
"collector": "illustrative-lab-collector",
"observation": {
"path": "/opt/lab/demo.txt",
"size_bytes": 64,
"sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
"owner_uid": 1000
}
}Visibility limits: Snapshots miss short-lived objects and do not identify who caused a change. A generic inventory agent is not guaranteed to expose firmware or kernel-level details.
DC0102 collection page — Enable Audit File Share / Detailed File Share on the lab file server; correlate share checks with file-system access and requesting host/account.
Required normalized fields: share, relative_path, access, source_ip.
Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.
{
"schema": "1200km.telemetry.example.v1",
"synthetic": true,
"timestamp": "2026-09-27T12:00:00Z",
"telemetry_id": "DC0102",
"collector": "illustrative-lab-collector",
"observation": {
"share": "\\\\lab-server\\demo",
"relative_path": "demo.txt",
"access": "read",
"source_ip": "192.0.2.10"
}
}Visibility limits: A policy checkbox alone does not guarantee an event. Host role, SACL, success/failure selection and audit policy precedence matter. Directory changes may arrive as multiple records.
DC0032 collection page — Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.
Required normalized fields: process_guid, image, parent_image, command_line, user.
<EventFiltering>
<ProcessCreate onmatch="include">
<Image condition="is">C:\Windows\System32\whoami.exe</Image>
</ProcessCreate>
</EventFiltering>This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>.
Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.
{
"schema": "1200km.telemetry.example.v1",
"synthetic": true,
"timestamp": "2026-09-27T12:00:00Z",
"telemetry_id": "DC0032",
"collector": "illustrative-lab-collector",
"observation": {
"process_guid": "lab-process-001",
"image": "C:\\Windows\\System32\\whoami.exe",
"parent_image": "C:\\Windows\\System32\\cmd.exe",
"command_line": "whoami",
"user": "LAB\\analyst"
}
}Visibility limits: Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.
Open the dedicated detection workspace · Existing query engineering
Correlate suspicious file transfers over SMB or Admin$ shares with process creation events (e.g., cmd.exe, powershell.exe, certutil.exe) that do not align with normal administrative behavior. Detect remote file writes followed by execution of transferred binaries.
Platforms: Windows.
Monitor scp, rsync, curl, sftp, or ftp processes initiating transfers to internal systems combined with file creation events in unusual directories. Correlate transfer activity with subsequent execution of those binaries.
Platforms: Linux.
Detect anomalous use of scp, rsync, curl, or third-party sync apps transferring executables into user directories. Correlate new file creation with immediate execution events.
Platforms: macOS.
Identify lateral transfer via datastore file uploads or internal scp/ssh sessions that result in new VMX/VMDK or script files. Correlate transfer with VM execution or datastore modification.
Platforms: ESXi.
4 exact-tagged source rules. A source tag is a discovery aid, not a relevance verdict. Check the observation point and actual condition of each rule.
MATCH(file_written_to_remote_share_or_host) AND file_hash_or_extension IN monitored_types -> ALERTEdge Anomaly · Sequence-Order Anomaly · Category-Combination Anomaly
Start from the exact analytic above. The collection-specific lenses below are analyst recommendations; they do not assert that an arbitrary statistical deviation detects this technique.
Anomaly Detection Atlas · Baseline, validation and blind spots
These are exact ATT&CK software-use relationships, including malware. They provide behavior context, not recommendations to download or execute malware. No safety or detector claim is inherited.
PsExec can be used to download or upload a file over a network share.[PsExec Russinovich]
Exact relationship: relationship--9f5c68fe-a32e-405d-ae58-0965f04855cbDustySky searches for network drives and removable media and duplicates itself onto them.[DustySky]
Exact relationship: relationship--ad5f49b0-8b92-43d1-99f3-c691ccb7a8acftp may be abused by adversaries to transfer tools or files between systems within a compromised environment.[Microsoft FTP][Linux FTP]
Exact relationship: relationship--349bc11d-b377-410b-9232-2c5f0fbde031cmd can be used to copy files to/from a remotely connected internal system.[TechNet Copy]
Exact relationship: relationship--fb866766-d3a5-46f6-9d0e-afc6bd1c7962Shamoon attempts to copy itself to remote machines on the network.[Palo Alto Shamoon Nov 2016]
Exact relationship: relationship--8ab5ee87-6fdf-447a-b622-0a68ed34e330BITSAdmin can be used to create BITS Jobs to upload and/or download files from SMB file servers.[Microsoft About BITS]
Exact relationship: relationship--338c0224-eb50-4027-925a-637ee765b187Impacket has used its `wmiexec` command, leveraging Windows Management Instrumentation, to remotely stage and execute payloads in victim networks.[Sygnia VelvetAnt 2024A]
Exact relationship: relationship--b58c89b5-cade-4622-b0bc-5d9a921afc60Expand can be used to download or upload a file over a network share.[LOLBAS Expand]
Exact relationship: relationship--6aa9250e-cbe8-4f47-9aef-bb178c2b6677Olympic Destroyer attempts to copy itself to remote machines on the network.[Talos Olympic Destroyer 2018]
Exact relationship: relationship--7e8101ce-f787-45f7-a593-62b664fbe08dWannaCry attempts to copy itself to remote computers after gaining access via an SMB exploit.[LogRhythm WannaCry]
Exact relationship: relationship--fe78de3a-107f-4870-b5a1-c60289d68decEmotet has copied itself to remote systems using the `service.exe` filename.[Binary Defense Emotes Wi-Fi Spreader]
Exact relationship: relationship--0694d72f-cf4b-4355-b485-ccbd8d3a22b2LockerGoga has been observed moving around the victim network via SMB, indicating the actors behind this ransomware are manually copying files form computer to computer instead of self-propagating.[Unit42 LockerGoga 2019]
Exact relationship: relationship--d80bbf0c-2fb4-4272-a878-65662452d3caesentutl can be used to copy files to/from a remote share.[LOLBAS Esentutl]
Exact relationship: relationship--3b10d114-ce08-4c8f-b8c6-e2ed13e04912Operators deploying Netwalker have used psexec to copy the Netwalker payload across accessible systems.[Sophos Netwalker May 2020]
Exact relationship: relationship--2dd1c028-bebc-4631-b17b-3dd27a595c00Lucifer can use certutil for propagation on Windows hosts within intranets.[Unit 42 Lucifer June 2020]
Exact relationship: relationship--427a272e-4500-4216-8816-a6c7d4492f3eStuxnet uses an RPC server that contains a file dropping routine and support for payload version updates for P2P communications within a victim network.[Nicolas Falliere, Liam O Murchu, Eric Chien February 2011]
Exact relationship: relationship--da63f54a-e6a4-414b-9d54-404b0a63d2f6HermeticWizard can copy files to other machines on a compromised network.[ESET Hermetic Wizard March 2022]
Exact relationship: relationship--a8fb73d8-e4c0-4f3f-86e7-a13768fae22bOutSteel can download the Saint Bot malware for follow-on execution.[Palo Alto Unit 42 OutSteel SaintBot February 2022 ]
Exact relationship: relationship--cd9c7491-e0c8-4d98-8ac7-d7cccf77e98eBlackCat can replicate itself across connected servers via `psexec`.[Microsoft BlackCat Jun 2022]
Exact relationship: relationship--0bca4956-d4c5-4149-a493-c0596701dd9aIPsec Helper can download additional payloads from command and control nodes and execute them.[SentinelOne Agrius 2021]
Exact relationship: relationship--1d56fffa-b10e-4d5d-809b-7b2dc33b9939INC Ransomware can push its encryption executable to multiple endpoints within compromised infrastructure.[Huntress INC Ransom Group August 2023]
Exact relationship: relationship--0788ef6e-c65f-481b-9d33-9ae7945bbc0eBlackByte Ransomware spreads itself laterally by writing the JavaScript launcher file to mapped shared folders.[Trustwave BlackByte 2021]
Exact relationship: relationship--61c4b285-ef0a-4cf6-ad8b-3599660211d4VIRTUALPITA is capable of file transfer and arbitrary command execution.[Google Cloud Threat Intelligence ESXi VIBs 2022]
Exact relationship: relationship--bf0531cd-410d-4b53-bd6d-61bb98dd5523VIRTUALPIE has file transfer capabilities.[Google Cloud Threat Intelligence ESXi VIBs 2022]
Exact relationship: relationship--c29d57a2-ebda-40eb-9023-361e6a89610aHavoc has the ability to copy files from one location to another.[Havoc Framework Documentation]
Exact relationship: relationship--6dc62107-cba2-4cf7-b788-3df0ef232966Qilin has used PsExec to distribute a second encryptor, named encryptor_1.exe, across the targeted environment.[Cisco Talos Qilin Ransomware OCT 2025]
Exact relationship: relationship--731fd895-2b35-4ac4-a16c-f85340543595SameCoin can copy its wiper executable to remote machines within the same Active Directory.[Check Point Wirte NOV 2024]
Exact relationship: relationship--73ad9e83-7e55-489d-ae44-deef090909b1Atomic evidence: 2 compatible documented candidates. Live lab status: not run for these imported procedures.
Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.
Simulates an attacker exfiltrating data over SMB over QUIC using the NET USE command.
Prerequisites:
- A file server running Windows Server 2022 Datacenter: Azure Edition
- A Windows 11 computer
- Windows Admin Center
Pinned Atomic procedure · 183235ca-8e6c-422c-88c2-3aa28c4825d9 · windows · powershell.
Elevation: required. Cleanup: not declared. This is source documentation, not an execution approval.
remote_path: The UNC path to the share on the file server (type string; source default \\example.com\sales)local_file: The local file to be transferred (type path; source default C:\path\to\file.txt)Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.
Simulates an attacker exfiltrating data over SMB over QUIC using the New-SmbMapping command.
Prerequisites:
- A file server running Windows Server 2022 Datacenter: Azure Edition
- A Windows 11 computer
- Windows Admin Center
Pinned Atomic procedure · d8d13303-159e-4f33-89f4-9f07812d016f · windows · powershell.
Elevation: required. Cleanup: not declared. This is source documentation, not an execution approval.
remote_path: The UNC path to the share on the file server (type string; source default \\example.com\sales)local_file: The local file to be transferred (type path; source default C:\path\to\file.txt)Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.
Download synthetic collection fixture (JSON) · Download the complete engineering workbook
This fixture exercises the listed collection fields. It does not reproduce Lateral Tool Transfer, label its example events as malicious, or measure detection effectiveness. Use the exact analytic and selected procedure to build an independently labelled behavior-positive dataset.
Not run in this browser. No network scan or attack command is executed by this control.
All-page audit and evidence inventory · This page’s machine-readable workbook
Pinned MITRE STIX source · SHA-256 81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352. Definition and procedure context are reproduced from this snapshot, not independently re-investigated incidents.
Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware or unusual data transfer over known tools and protocols like FTP can be used to mitigate activity at the network level. Signatures are often for unique indicators within protocols and may be based on the specific obfuscation technique used by a particular adversary or tool, and will likely be different across various malware families and versions. [University of Birmingham C2]
Consider using the host firewall to restrict file sharing communications such as SMB. [Microsoft Preventing SMB]
Source procedure platform / method / executor tags:
These are explicit actor-to-technique associations in the existing Threat Matrix snapshot, not attribution of an event or proof that a detector identifies the actor. No tool-to-actor relationship is inferred.
Curated research views reached through an exact source technique, a catalog model, or a reviewed collection reference. These are navigation associations, not claims of detector effectiveness or sensor equivalence.
Telemetry contracts · Maintained query examples · Validation and blind spots
Pinned research references. No browser attack runner or production-validated detector is asserted. Imported procedures remain unvalidated; any bounded lab evidence has its own scope. ATT&CK / Atomic provenance · Detection provenance.