MITRE ATT&CKtechnique

T1570 Lateral Tool Transfer

Published 2020-03-11 Modified 2026-09-03 Official page ↗
Domain
enterprise
Tactics
Lateral Movement
Platforms
ESXi, Linux, macOS, Windows
Version
1.4
Created
2020-03-11

Description

Adversaries may transfer tools or other files between systems in a compromised environment. Once brought into the victim environment (i.e., Ingress Tool Transfer) files may then be copied from one system to another to stage adversary tools or other files over the course of an operation. Adversaries may copy files between internal victim systems to support lateral movement using inherent file sharing protocols such as file sharing over SMB/Windows Admin Shares to connected network shares or with authenticated connections via Remote Desktop Protocol. Files can also be transferred using native or otherwise present tools on the victim system, such as scp, rsync, curl, sftp, and ftp. In some cases, adversaries may be able to leverage Web Services such as Dropbox or OneDrive to copy files from one machine to another via shared, automatically synced folders.

Related

Tactic · MITRE ATT&CK (1)

  • TA0008 Lateral Movement tactic

Referenced by MITRE ATT&CK · mitigates (2)

  • M1037 Filter Network Traffic mitigation
  • M1031 Network Intrusion Prevention mitigation

Referenced by MITRE ATT&CK · uses (55)

  • C0063 2025 Poland Wiper Attacks campaign
  • S9030 SameCoin software (malware)
  • C0058 SharePoint ToolShell Exploitation campaign
  • G1051 Medusa Group group
  • S1242 Qilin software (malware)
  • S1229 Havoc software (malware)
  • S1218 VIRTUALPIE software (malware)
  • S1217 VIRTUALPITA software (malware)
  • G1048 UNC3886 group
  • G1046 Storm-1811 group
  • G1047 Velvet Ant group
  • S1180 BlackByte Ransomware software (malware)
  • G1043 BlackByte group
  • C0038 HomeLand Justice campaign
  • G1032 INC Ransom group
  • S1139 INC Ransomware software (malware)
  • S1132 IPsec Helper software (malware)
  • G1030 Agrius group
  • C0034 2022 Ukraine Electric Power Attack campaign
  • C0028 2015 Ukraine Electric Power Attack campaign
  • G1017 Volt Typhoon group
  • C0025 2016 Ukraine Electric Power Attack campaign
  • S1068 BlackCat software (malware)
  • C0018 C0018 campaign
  • C0015 C0015 campaign
  • C0014 Operation Wocao campaign
  • G1007 Aoqin Dragon group
  • G1003 Ember Bear group
  • S1017 OutSteel software (malware)
  • S0698 HermeticWizard software (malware)
Show all 55 ›

Referenced by Compliance · mitigates (16)

  • CIS-13.4 Perform Traffic Filtering Between Network Segments CIS Safeguard v8.1
  • CIS-13.8 Deploy a Network Intrusion Prevention Solution CIS Safeguard v8.1
  • CIS-4.4 Implement and Manage a Firewall on Servers CIS Safeguard v8.1
  • CIS-4.5 Implement and Manage a Firewall on End-User Devices CIS Safeguard v8.1
  • CIS-4.8 Uninstall or Disable Unnecessary Services on Enterprise Assets and Software CIS Safeguard v8.1
  • NIST-AC-3 Access Enforcement NIST 800-53 control
  • NIST-AC-4 Information Flow Enforcement NIST 800-53 control
  • NIST-CA-7 Continuous Monitoring NIST 800-53 control
  • NIST-CM-2 Baseline Configuration NIST 800-53 control
  • NIST-CM-6 Configuration Settings NIST 800-53 control
  • NIST-CM-7 Least Functionality NIST 800-53 control
  • NIST-SC-7 Boundary Protection NIST 800-53 control
  • NIST-SI-10 Information Input Validation NIST 800-53 control
  • NIST-SI-15 Information Output Filtering NIST 800-53 control
  • NIST-SI-3 Malicious Code Protection NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control

References