T1570

Lateral Tool Transfer

Lateral Movement Last updated:

Adversaries may transfer tools or other files between systems in a compromised environment. Once initial access is established, tools are staged across multiple hosts to support lateral movement, ransomware deployment, data exfiltration, or persistence. Transfer mechanisms include SMB via Windows Admin Shares (\\host\ADMIN$, \\host\C$), RDP file sharing, and native utilities such as scp, rsync, sftp, ftp, and curl. Living-Off-The-Land Binaries (LOLBins) including certutil, bitsadmin, esentutl, and robocopy are frequently abused to perform transfers while blending with legitimate activity. PsExec is widely used to copy and remotely execute binaries on target hosts. Real-world threat actors including BlackCat ransomware (psexec-based propagation), Netwalker (psexec), INC Ransomware (push to multiple endpoints), Medusa Group (PDQ Deploy for binary distribution), Emotet (network self-replication via service.exe), and Volt Typhoon (web shell replication across servers) have leveraged these techniques to propagate tools during intrusions.

What is T1570 Lateral Tool Transfer?

Lateral Tool Transfer (T1570) maps to the Lateral Movement tactic — the adversary is trying to move through your environment in MITRE ATT&CK.

This page provides production-ready detection logic for Lateral Tool Transfer, covering the data sources and telemetry it touches: File: File Creation, Network Share: Network Share Access, Process: Process Creation, Command: Command Execution, Microsoft Defender for Endpoint. The queries below are rated high severity at high confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.

MITRE ATT&CK

Tactic
Lateral Movement
Technique
T1570 Lateral Tool Transfer
Canonical reference
https://attack.mitre.org/techniques/T1570/
Microsoft Sentinel / Defender
kusto 
let ExecutableExtensions = dynamic([".exe", ".dll", ".ps1", ".bat", ".cmd", ".vbs", ".hta", ".js", ".msi", ".scr", ".cpl"]);
let LOLBins = dynamic(["certutil.exe", "bitsadmin.exe", "esentutl.exe", "robocopy.exe", "expand.exe", "makecab.exe"]);
let TransferTools = dynamic(["psexec.exe", "psexec64.exe", "paexec.exe", "scp.exe", "sftp.exe", "ftp.exe", "winscp.exe"]);
let SensitiveDirs = dynamic(["\\Windows\\Temp\\", "\\Windows\\System32\\", "\\Windows\\SysWOW64\\", "\\ProgramData\\", "\\Users\\Public\\"]);
// Branch A: LOLBins executing lateral file transfers
let LOLBinTransfers = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName has_any (LOLBins)
| where ProcessCommandLine has @"\\\\"
    or (FileName =~ "certutil.exe" and ProcessCommandLine has_any ("urlcache", "-f", "-split"))
    or (FileName =~ "bitsadmin.exe" and ProcessCommandLine has_any ("/transfer", "/addfile", "/upload"))
    or (FileName =~ "esentutl.exe" and ProcessCommandLine has_any ("/cp", "/y"))
    or (FileName =~ "robocopy.exe" and ProcessCommandLine matches regex @"\\\\[A-Za-z0-9\-\.]+\\")
| extend IsCertutil = FileName =~ "certutil.exe"
| extend IsBitsadmin = FileName =~ "bitsadmin.exe"
| extend IsEsentutl = FileName =~ "esentutl.exe"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
         InitiatingProcessFileName, InitiatingProcessCommandLine,
         IsCertutil, IsBitsadmin, IsEsentutl, DetectionBranch="LOLBin_Transfer";
// Branch B: Transfer tools referencing internal hosts or UNC paths
let ToolTransfers = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName has_any (TransferTools)
| where ProcessCommandLine has @"\\\\"
    or ProcessCommandLine matches regex @"(?:^|[\s\t@:])(?:10\.|172\.(?:1[6-9]|2[0-9]|3[0-1])\.|192\.168\.)"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
         InitiatingProcessFileName, InitiatingProcessCommandLine,
         DetectionBranch="Transfer_Tool";
// Branch C: Executables dropped via SMB (System process writing executables to sensitive directories)
let SMBExecutableDrops = DeviceFileEvents
| where Timestamp > ago(24h)
| where ActionType == "FileCreated"
| where FileName has_any (ExecutableExtensions)
| where FolderPath has_any (SensitiveDirs)
| where InitiatingProcessFileName =~ "System"
| project Timestamp, DeviceName,
         AccountName=InitiatingProcessAccountName,
         FileName, FolderPath, SHA256,
         InitiatingProcessFileName, InitiatingProcessCommandLine,
         DetectionBranch="SMB_Executable_Drop";
// Union all branches
LOLBinTransfers
| union ToolTransfers
| union SMBExecutableDrops
| sort by Timestamp desc

Detects lateral tool transfer via three complementary branches using Microsoft Defender for Endpoint telemetry. Branch A identifies LOLBins (certutil, bitsadmin, esentutl, robocopy) executing file transfers with UNC paths or known transfer-specific flags. Branch B identifies dedicated transfer tools (psexec, scp, sftp, ftp, winscp) referencing internal IP ranges or UNC paths. Branch C detects executables written to sensitive directories via the Windows System process, the telemetry signature of an SMB file write from a remote host. Together these branches cover the primary T1570 transfer mechanisms without requiring a single monolithic query.

high severity high confidence

Data Sources

File: File Creation Network Share: Network Share Access Process: Process Creation Command: Command Execution Microsoft Defender for Endpoint

Required Tables

DeviceProcessEvents DeviceFileEvents

False Positives

  • SCCM/Microsoft Endpoint Configuration Manager pushes software to endpoints via SMB, causing the System process to create executables in ProgramData and Windows directories — generates Branch C alerts
  • IT automation tools (Ansible WinRM, Chef, Puppet, PDQ Deploy) legitimately use robocopy, bitsadmin, and psexec for software distribution across managed hosts
  • Backup agents (Veeam, Acronis, Commvault) use certutil and bitsadmin for scheduled transfer tasks, and robocopy for file replication jobs
  • Developer workflows using scp or sftp to deploy artifacts to internal build/staging servers from workstations
  • Security and vulnerability scanning tools that copy lightweight agents to remote hosts for assessment purposes

Sigma rule & cross-platform mapping

The detection logic for Lateral Tool Transfer (T1570) above is provided in a vendor-neutral form so you can deploy it on any SIEM. The same logic is shipped here as native KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the following logsource: 

logsource:
  category: process_creation
  product: windows

Browse the community-maintained Sigma rules for this technique:

SigmaHQ rules for T1570 Sigma rules on detection.fyi

Platform-specific guides for T1570

Detect in Microsoft Sentinel (KQL) Detect in Splunk (SPL) Detect in Elastic Security (Elastic) Detect in IBM QRadar (QRadar) Detect in Sumo Logic CSE (Sumo) Detect in Google Chronicle (YARA-L) Detect in CrowdStrike LogScale (LogScale)
Last updated: 2026-04-21 Research depth: deep
References (11)

Testing Methodology

Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Copy Executable to Remote ADMIN$ Share via SMB

    Expected signal: Sysmon Event ID 1: cmd.exe with CommandLine containing '\\127.0.0.1\ADMIN$'. Sysmon Event ID 11 on the destination (localhost): FileCreated event for lateral_calc_test.exe in C:\Windows\Temp\ with Image=System (PID 4) — this is the SMB server process creating the file. Windows Security Event ID 5145 if object access auditing enabled: network share access to ADMIN$ from localhost.

  2. Test 2LOLBin Transfer via Certutil URL Cache to UNC Path Staging

    Expected signal: Sysmon Event ID 1: certutil.exe with CommandLine containing '-urlcache', '-split', '-f', and the destination path. Sysmon Event ID 3: outbound network connection to 127.0.0.1:8080 (connection refused, but the attempt is logged). Windows Security Event ID 4688 if process command line auditing is enabled.

  3. Test 3BITSAdmin SMB File Transfer Between Internal Hosts

    Expected signal: Sysmon Event ID 1: bitsadmin.exe with CommandLine containing '/transfer', 'LateralMoveJob', '/download', and the UNC source path '\\127.0.0.1\C$'. Sysmon Event ID 11: FileCreated for bits_lateral_test.exe in C:\Windows\Temp\. Sysmon Event ID 3: SMB connection to 127.0.0.1:445 from bitsadmin process. BITS Event ID 59 in Microsoft-Windows-Bits-Client/Operational log: job transfer started.

  4. Test 4Esentutl File Copy to Remote Share

    Expected signal: Sysmon Event ID 1: esentutl.exe with CommandLine containing '/cp' and the source/destination paths. Sysmon Event ID 11: FileCreated for esentutl_lateral_test.exe in C:\Windows\Temp\, with Image=esentutl.exe as the initiating process. Windows Security Event ID 4688 if process auditing enabled.

  5. Test 5SCP Lateral File Transfer to Internal Host

    Expected signal: Linux auditd EXECVE record: scp with arguments including the destination IP 192.168.1.100. Syslog entry from the SSH client showing connection attempt. On macOS: unified log entry from com.openssh.sshd. If Sysmon for Linux is deployed: ProcessCreate event for scp with CommandLine containing the internal IP.

Response Playbook

Triage

  1. Identify the transfer mechanism: was this a LOLBin (certutil, bitsadmin, esentutl), a dedicated tool (psexec, scp), or an SMB write detected via the System process? The DetectionBranch field in alerts directs you to the relevant telemetry.
  2. Determine the source and destination hosts: for LOLBin/tool transfers, find the source host executing the transfer and the destination UNC path or IP. For SMB drops, the alert device is the destination — use DeviceNetworkEvents to find which host connected via port 445 around the same timestamp.
  3. Inspect the transferred file: hash the file if it still exists (Get-FileHash -Path <path> -Algorithm SHA256) and submit to VirusTotal or your threat intel platform. Check if the filename matches legitimate software or is masquerading as a system binary.
  4. Examine the user context: is the account a service account, domain admin, or standard user? Review Active Directory group membership (Get-ADGroupMember) and check if a change ticket exists for this activity. Privileged account misuse escalates severity.
  5. Check for subsequent execution of the transferred file: in DeviceProcessEvents, search for the transferred filename within 30 minutes of the transfer. If the file was executed immediately after transfer, this is a strong indicator of active attack rather than IT operations.
  6. Review the initiating process chain: for LOLBin detections, examine InitiatingProcessFileName and InitiatingProcessCommandLine to determine what launched the transfer. A LOLBin launched by cmd.exe or powershell.exe is more suspicious than one launched by a known deployment agent (ccmexec.exe, puppet.exe).

Containment

  1. If the transferred file has been confirmed malicious (positive AV/TI hit) or was immediately executed: isolate the destination host from the network using EDR host isolation or emergency VLAN change before additional lateral movement occurs.
  2. If the same file hash appears on multiple hosts (indicating active propagation): prioritize isolating hosts with the highest privilege level or domain controller access, and block the file hash at the EDR level across all endpoints.
  3. If a privileged account (domain admin, service account) was used for the transfer: disable the account in Active Directory (Disable-ADAccount) and revoke active Kerberos tickets (klist purge on affected hosts, or use the Domain Controller to purge all sessions for the account).
  4. Block the UNC path or source IP at the firewall if the transfer originated from a compromised internal host, to prevent further staging to other destinations.
  5. If bitsadmin or certutil was used to download from an external URL: block that URL/domain at the web proxy and DNS layer immediately, and search for other hosts that resolved or connected to the same destination.

Evidence Collection

  1. File system: Collect a full copy (or forensic image if malicious) of the transferred file from its destination path before any remediation that would delete it. Preserve metadata (creation, modification, access timestamps) using Get-Item or robocopy /COPYALL.
  2. Process: Sysmon Event ID 1 logs from both the source host (process executing the transfer tool) and destination host (any process that subsequently executed the file). Collect from C:\Windows\System32\winevt\Logs\Microsoft-Windows-Sysmon%4Operational.evtx.
  3. File: Sysmon Event ID 11 logs from the destination host showing file creation details including Hashes (MD5, SHA256) and the Image (process) that created the file.
  4. Network: Sysmon Event ID 3 (Network Connection) logs from the source host around the transfer timestamp — captures destination IP, port, and initiating process for SMB (port 445) or SSH (port 22) transfers.
  5. Windows Security log Event ID 5145 (if object access auditing is enabled): records network share file access with source IP, account name, share name, and object name on the destination host.
  6. Prefetch files: C:\Windows\Prefetch\CERTUTIL.EXE-*.pf, BITSADMIN.EXE-*.pf, PSEXEC.EXE-*.pf — execution timestamps and list of DLLs/files accessed by the transfer tool.
  7. BITS transfer job database: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db — contains history of all BITS transfer jobs including source URLs/paths and destination paths, persistent even after transfer completion.
  8. MFT ($MFT): If available via forensic acquisition, the Master File Table provides precise file creation timestamps that cannot be altered by standard user-space operations, useful for confirming transfer timeline.

Escalation Criteria

  • ! The transferred file was subsequently executed on the destination host within 30 minutes — indicates active attack progression rather than staging.
  • ! The same file hash (SHA256) appears on 3 or more hosts within a 2-hour window — strong indicator of automated propagation consistent with ransomware or worm-like behavior.
  • ! Transfer was performed using a domain administrator or high-privileged service account with no corresponding change management ticket — indicates credential compromise or insider threat.
  • ! The destination path is on a domain controller, critical server (backup, authentication, file server), or host with known sensitive data.
  • ! The transferred binary is packed, obfuscated, or has a low occurrence count in your environment (first-seen executable) — use file reputation via EDR telemetry or VirusTotal.
  • ! The transfer tool (psexec, scp) was spawned by an unusual parent process such as a web server (w3wp.exe, nginx), document application (winword.exe, excel.exe), or script interpreter (wscript.exe, cscript.exe) — indicates initial access via exploitation.

Investigation Guide

Forensic Artifacts

  • > File System: Transferred file at destination path with creation timestamp matching the transfer event — compare with birth time in MFT ($STANDARD_INFORMATION vs $FILE_NAME) to detect timestamp manipulation.
  • > Registry: HKCU\Software\Microsoft\Terminal Server Client\Default — recent RDP connections from the source host, indicating RDP-based file transfer channel.
  • > File System: C:\Windows\Prefetch\PSEXEC.EXE-*.pf, CERTUTIL.EXE-*.pf, BITSADMIN.EXE-*.pf — execution timestamps and referenced file paths for transfer tools.
  • > BITS Database: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db — persistent record of all BITS transfer jobs including source, destination, and timestamps.
  • > Event Log: Microsoft-Windows-SMBClient/Security (Event ID 31017) — SMB signing failures that may indicate MitM or unusual SMB client activity.
  • > Event Log: Windows Security Event ID 5145 — Detailed network share object access log with source IP, account, and share/file path (requires object access auditing to be enabled).
  • > Event Log: Windows Security Event ID 4648 — Explicit credential logon events that accompany authenticated SMB connections used for admin share access.
  • > Network: NetFlow/firewall logs for port 445 (SMB), 22 (SSH), 21 (FTP) connections between internal hosts — cross-correlate with alert timestamp to confirm transfer source.
  • > Sysmon Event ID 23 (File Delete) or 26 (File Delete Detected) — adversaries may delete the transferred tool after execution; these events preserve the SHA256 hash of the deleted file.

Tuning Guidance

Start by baselining legitimate transfer activity in your environment. The highest-volume false positive source is typically SCCM/ConfigMgr, which uses SMB to distribute software packages — DeviceName and InitiatingProcessFileName can be used to exclude known management hosts (sccm-server, mecm-site) from Branch C (SMB_Executable_Drop). For Branch A (LOLBin_Transfer), build an allowlist of specific command-line patterns used by your backup and monitoring agents — never exclude the binary outright, always match on command-line context. For Branch B (Transfer_Tool), psexec from a single known jump server used by your IT team is a legitimate FP; add an exclusion scoped to that source DeviceName and a known admin AccountName. To reduce SMB_Executable_Drop noise without eliminating it: add a filter for FolderPath not starting with known software deployment staging paths (e.g., C:\Windows\ccmcache), and require that FileName does not match your approved software catalog hashes. For the hunting queries, build a hash allowlist populated from your software deployment system and subtract it from the file-spread query before analyst review. If your environment has heavy developer use of scp/sftp to internal build servers, add those specific source hosts to an exclusion for Branch B but alert on any other source.

Hunting Queries

Hunt for the same file hash appearing on 3 or more hosts within a 2-hour window. This pattern identifies tool propagation — a characteristic of ransomware pre-positioning, worm-like lateral movement, and post-exploitation frameworks distributing implants. The SpreadWindowMinutes field helps distinguish rapid automated propagation (minutes) from normal IT distribution (hours to days). Results should be cross-referenced against known-good hashes from software deployment baselines.

Hunting — KQL
kql 
DeviceFileEvents
| where Timestamp > ago(7d)
| where ActionType == "FileCreated"
| where isnotempty(SHA256)
| where FileName endswith ".exe" or FileName endswith ".dll" or FileName endswith ".ps1"
| summarize
    HostCount=dcount(DeviceName),
    Hosts=make_set(DeviceName, 20),
    FirstSeen=min(Timestamp),
    LastSeen=max(Timestamp),
    Paths=make_set(FolderPath, 5)
    by SHA256, FileName
| where HostCount >= 3
| extend SpreadWindowMinutes = datetime_diff('minute', LastSeen, FirstSeen)
| where SpreadWindowMinutes <= 120
| sort by HostCount desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11
(TargetFilename LIKE "%.exe" OR TargetFilename LIKE "%.dll" OR TargetFilename LIKE "%.ps1")
Hashes=*
| rex field=Hashes "SHA256=(?P<SHA256>[A-Fa-f0-9]{64})"
| where isnotnull(SHA256) AND SHA256!=""
| stats dc(host) as HostCount, values(host) as Hosts, min(_time) as FirstSeen, max(_time) as LastSeen, values(TargetFilename) as FilePaths by SHA256
| where HostCount >= 3
| eval SpreadWindowMinutes=round((LastSeen - FirstSeen) / 60, 1)
| where SpreadWindowMinutes <= 120
| sort - HostCount

Hunt for workstations making SMB (port 445) connections to 3 or more internal hosts, initiated by non-system processes. Legitimate workstation-to-workstation SMB is uncommon in most environments — it typically indicates ransomware scanning for shares to copy encryptors to, post-exploitation frameworks mapping reachable hosts, or an attacker manually pushing tools via admin shares. Filter out known management servers and system processes before reviewing. The Processes field reveals which application is initiating the SMB fan-out.

Hunting — KQL
kql 
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemotePort == 445
| where RemoteIPType != "Public"
| where not(DeviceName has_any ("srv", "server", "dc", "fs", "nas", "backup", "print"))
| where not(InitiatingProcessFileName in~ ("svchost.exe", "System", "lsass.exe"))
| summarize
    TargetCount=dcount(RemoteIP),
    Targets=make_set(RemoteIP, 20),
    Processes=make_set(InitiatingProcessFileName, 5),
    FirstSeen=min(Timestamp),
    LastSeen=max(Timestamp)
    by DeviceName, AccountName
| where TargetCount >= 3
| sort by TargetCount desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=3
DestinationPort=445
NOT (DestinationIp="0.0.0.0" OR DestinationIp="127.0.0.1" OR DestinationIp="::1")
NOT (Image="*\\svchost.exe" OR Image="System")
NOT (host="*srv*" OR host="*server*" OR host="*dc*" OR host="*fs*")
| stats dc(DestinationIp) as TargetCount, values(DestinationIp) as Targets, values(Image) as Processes, min(_time) as FirstSeen, max(_time) as LastSeen by host, User
| where TargetCount >= 3
| sort - TargetCount

Hunt for executables that were dropped into staging directories by a transfer tool or the System process and then executed within 30 minutes. This close temporal correlation between file creation and execution in a staging path is a strong indicator of active exploitation — the file was transferred in and immediately weaponized. This query finds patterns the main detection misses by correlating two separate event types across the same device and timeframe.

Hunting — KQL
kql 
let StagingPaths = dynamic(["\\Windows\\Temp\\", "\\Temp\\", "\\ProgramData\\", "\\Users\\Public\\"]);
let TransferProcesses = dynamic(["certutil.exe", "bitsadmin.exe", "esentutl.exe", "robocopy.exe", "psexec.exe", "scp.exe", "sftp.exe"]);
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FolderPath has_any (StagingPaths)
| where FileName endswith ".exe"
| join kind=inner (
    DeviceFileEvents
    | where Timestamp > ago(7d)
    | where ActionType == "FileCreated"
    | where FolderPath has_any (StagingPaths)
    | where FileName endswith ".exe"
    | where InitiatingProcessFileName has_any (TransferProcesses) or InitiatingProcessFileName =~ "System"
    | project FileCreateTime=Timestamp, DeviceName, DroppedFile=FileName, DroppedPath=FolderPath, DropperProcess=InitiatingProcessFileName, SHA256
) on DeviceName, $left.FileName == $right.DroppedFile
| where Timestamp between ((FileCreateTime - 10m) .. (FileCreateTime + 30m))
| project FileCreateTime, ExecuteTime=Timestamp, DeviceName, AccountName, DroppedFile, DroppedPath, DropperProcess, SHA256, ExecutingProcessCommandLine=ProcessCommandLine
| sort by FileCreateTime desc

Atomic Red Team Tests

Test 1 Copy Executable to Remote ADMIN$ Share via SMB
windows

Uses the native Windows copy command to push an executable (calc.exe as a benign proxy) to the ADMIN$ administrative share on localhost, simulating the technique used by BlackCat, Netwalker, and Emotet to propagate tools across a network. In real attacks this targets \\<victim>\ADMIN$\Temp\ or \\<victim>\C$\Windows\Temp\. Running against localhost tests telemetry without requiring network access.

Command

powershell 
cmd.exe /c copy C:\Windows\System32\calc.exe \\127.0.0.1\ADMIN$\Temp\lateral_calc_test.exe

Cleanup

powershell 
cmd.exe /c del \\127.0.0.1\ADMIN$\Temp\lateral_calc_test.exe 2>nul

Expected Telemetry

Sysmon Event ID 1: cmd.exe with CommandLine containing '\\127.0.0.1\ADMIN$'. Sysmon Event ID 11 on the destination (localhost): FileCreated event for lateral_calc_test.exe in C:\Windows\Temp\ with Image=System (PID 4) — this is the SMB server process creating the file. Windows Security Event ID 5145 if object access auditing enabled: network share access to ADMIN$ from localhost.

Expected Detection

Branch C (SMB_Executable_Drop) fires on the FileCreated event: InitiatingProcessFileName=System, FolderPath contains \Windows\Temp\, FileName ends with .exe. In SPL: IsSMBDrop=1, DetectionMethod=SMB_Executable_Drop.

Test 2 LOLBin Transfer via Certutil URL Cache to UNC Path Staging
windows

Uses certutil.exe with -urlcache to attempt a file download, simulating the technique used by Lucifer malware and documented in LOLBAS to move files using a trusted Windows binary. The URL points to localhost port 8080 — the connection will fail but the process creation event with the suspicious certutil flags is generated, triggering detection. In real intrusions, attackers use certutil to pull from attacker-controlled HTTP servers or copy between internal hosts.

Command

powershell 
certutil.exe -urlcache -split -f http://127.0.0.1:8080/lateral_tool.exe C:\Windows\Temp\certutil_lateral_test.exe

Cleanup

powershell 
cmd.exe /c del C:\Windows\Temp\certutil_lateral_test.exe 2>nul & certutil.exe -urlcache -f http://127.0.0.1:8080/lateral_tool.exe delete 2>nul

Expected Telemetry

Sysmon Event ID 1: certutil.exe with CommandLine containing '-urlcache', '-split', '-f', and the destination path. Sysmon Event ID 3: outbound network connection to 127.0.0.1:8080 (connection refused, but the attempt is logged). Windows Security Event ID 4688 if process command line auditing is enabled.

Expected Detection

Branch A (LOLBin_Transfer) fires: FileName=certutil.exe, ProcessCommandLine contains 'urlcache' and '-f'. KQL: DetectionBranch=LOLBin_Transfer, IsCertutil=true. SPL: IsCertutil=1, DetectionMethod=Certutil_Transfer.

Test 3 BITSAdmin SMB File Transfer Between Internal Hosts
windows

Uses bitsadmin.exe to create a BITS job that downloads a file from a UNC path, simulating the documented T1570+T1197 combination used by threat actors to transfer tools between internal hosts via SMB while leveraging the Background Intelligent Transfer Service for stealth and persistence. BITS jobs survive reboots until explicitly deleted, making this a durable transfer mechanism.

Command

powershell 
bitsadmin.exe /transfer LateralMoveJob /download /priority FOREGROUND \\127.0.0.1\C$\Windows\System32\calc.exe C:\Windows\Temp\bits_lateral_test.exe

Cleanup

powershell 
cmd.exe /c del C:\Windows\Temp\bits_lateral_test.exe 2>nul & bitsadmin.exe /cancel LateralMoveJob 2>nul

Expected Telemetry

Sysmon Event ID 1: bitsadmin.exe with CommandLine containing '/transfer', 'LateralMoveJob', '/download', and the UNC source path '\\127.0.0.1\C$'. Sysmon Event ID 11: FileCreated for bits_lateral_test.exe in C:\Windows\Temp\. Sysmon Event ID 3: SMB connection to 127.0.0.1:445 from bitsadmin process. BITS Event ID 59 in Microsoft-Windows-Bits-Client/Operational log: job transfer started.

Expected Detection

Branch A (LOLBin_Transfer) fires: FileName=bitsadmin.exe, ProcessCommandLine contains '/transfer' and UNC path. KQL: DetectionBranch=LOLBin_Transfer, IsBitsadmin=true. SPL: IsBitsadmin=1, DetectionMethod=BITSAdmin_Transfer.

Test 4 Esentutl File Copy to Remote Share
windows

Uses esentutl.exe with the /cp (copy) flag to copy a local file, demonstrating the documented LOLBAS technique where esentutl is abused to copy files between hosts. Esentutl is a legitimate Windows Extensible Storage Engine utility that can copy arbitrary files including locked/in-use files, making it valuable for adversaries copying system files. Volt Typhoon and other groups have used similar LOLBins for quiet lateral tool staging.

Command

powershell 
esentutl.exe /cp C:\Windows\System32\calc.exe /d C:\Windows\Temp\esentutl_lateral_test.exe

Cleanup

powershell 
cmd.exe /c del C:\Windows\Temp\esentutl_lateral_test.exe 2>nul

Expected Telemetry

Sysmon Event ID 1: esentutl.exe with CommandLine containing '/cp' and the source/destination paths. Sysmon Event ID 11: FileCreated for esentutl_lateral_test.exe in C:\Windows\Temp\, with Image=esentutl.exe as the initiating process. Windows Security Event ID 4688 if process auditing enabled.

Expected Detection

Branch A (LOLBin_Transfer) fires: FileName=esentutl.exe, ProcessCommandLine contains '/cp'. KQL: DetectionBranch=LOLBin_Transfer, IsEsentutl=true. SPL: IsEsentutl=1, DetectionMethod=Esentutl_Transfer.

Test 5 SCP Lateral File Transfer to Internal Host
linux

Uses OpenSSH scp to transfer a file to an internal IP address, simulating the technique used by APT32 and other Linux/macOS-targeting threat actors to push tools between compromised hosts via SSH. The command will fail authentication unless a target host is available, but the process creation event with the internal IP in the command line is generated. Replace 192.168.1.100 with a reachable internal test host for a full end-to-end test.

Command

bash 
scp /tmp/lateral_test_payload.sh [email protected]:/tmp/lateral_test_payload.sh

Cleanup

bash 
rm -f /tmp/lateral_test_payload.sh

Expected Telemetry

Linux auditd EXECVE record: scp with arguments including the destination IP 192.168.1.100. Syslog entry from the SSH client showing connection attempt. On macOS: unified log entry from com.openssh.sshd. If Sysmon for Linux is deployed: ProcessCreate event for scp with CommandLine containing the internal IP.

Expected Detection

Branch B (Transfer_Tool) fires if Sysmon for Linux is deployed: FileName=scp, ProcessCommandLine matches internal RFC1918 IP pattern. For auditd-based detection, a separate Splunk sourcetype=linux_audit query on execve syscalls with 'scp' and internal IP patterns would trigger.

Related Detections

Tactic Hub

TA0008Lateral Movement

Related Techniques

T1105Ingress Tool TransferT1021.002SMB/Windows Admin SharesT1021.001Remote Desktop ProtocolT1021.004SSHT1197BITS JobsT1059.001PowerShellT1059.003Windows Command ShellT1569.002Service ExecutionT1027Obfuscated Files or InformationT1486Data Encrypted for Impact

Same Tactic: Lateral Movement

Popular Detections