MITRE ATT&CKtechnique
T0867 Lateral Tool Transfer
- Domain
- ics
- Tactics
- Lateral Movement
- Platforms
- Embedded, Windows, Linux
- Version
- 1.1
- Created
- 2020-05-21
Description
Adversaries may transfer tools or other files from one system to another to stage adversary tools or other files over the course of an operation. Copying of files may also be performed laterally between internal victim systems to support Lateral Movement with remote Execution using inherent file sharing protocols such as file sharing over SMB to connected network shares.
In control systems environments, malware may use SMB and other file sharing protocols to move laterally through industrial networks.
Related
Tactic · MITRE ATT&CK (1)
- TA0109 Lateral Movement tactic
Referenced by MITRE ATT&CK · mitigates (1)
- M0931 Network Intrusion Prevention mitigation
Referenced by MITRE ATT&CK · uses (8)
- C0030 Triton Safety Instrumented System Attack campaign
- C0028 2015 Ukraine Electric Power Attack campaign
- C0025 2016 Ukraine Electric Power Attack campaign
- S1045 INCONTROLLER software (malware)
- S0606 Bad Rabbit software (malware)
- S0603 Stuxnet software (malware)
- S0368 NotPetya software (malware)
- S0366 WannaCry software (malware)
References
- https://attack.mitre.org/techniques/T1570/ Enterprise ATT&CK