Detect Lateral Tool Transfer in Elastic Security
Adversaries may transfer tools or other files between systems in a compromised environment. Once initial access is established, tools are staged across multiple hosts to support lateral movement, ransomware deployment, data exfiltration, or persistence. Transfer mechanisms include SMB via Windows Admin Shares (\\host\ADMIN$, \\host\C$), RDP file sharing, and native utilities such as scp, rsync, sftp, ftp, and curl. Living-Off-The-Land Binaries (LOLBins) including certutil, bitsadmin, esentutl, and robocopy are frequently abused to perform transfers while blending with legitimate activity. PsExec is widely used to copy and remotely execute binaries on target hosts. Real-world threat actors including BlackCat ransomware (psexec-based propagation), Netwalker (psexec), INC Ransomware (push to multiple endpoints), Medusa Group (PDQ Deploy for binary distribution), Emotet (network self-replication via service.exe), and Volt Typhoon (web shell replication across servers) have leveraged these techniques to propagate tools during intrusions.
MITRE ATT&CK
- Tactic
- Lateral Movement
- Technique
- T1570 Lateral Tool Transfer
- Canonical reference
- https://attack.mitre.org/techniques/T1570/
Elastic Detection Query
sequence by host.name with maxspan=5m
[
any where (
/* Branch A: LOLBin lateral transfers */
(
event.category == "process" and event.type == "start" and
process.name in~ ("certutil.exe", "bitsadmin.exe", "esentutl.exe", "robocopy.exe", "expand.exe", "makecab.exe") and
(
process.command_line like~ "*\\\\*" or
(process.name == "certutil.exe" and (process.command_line like~ "*urlcache*" or process.command_line like~ "*-f*" or process.command_line like~ "*-split*")) or
(process.name == "bitsadmin.exe" and (process.command_line like~ "*/transfer*" or process.command_line like~ "*/addfile*" or process.command_line like~ "*/upload*")) or
(process.name == "esentutl.exe" and (process.command_line like~ "*/cp*" or process.command_line like~ "*/y*")) or
(process.name == "robocopy.exe" and process.command_line like~ "*\\\\*")
)
) or
/* Branch B: Transfer tools referencing internal hosts */
(
event.category == "process" and event.type == "start" and
process.name in~ ("psexec.exe", "psexec64.exe", "paexec.exe", "scp.exe", "sftp.exe", "ftp.exe", "winscp.exe") and
(
process.command_line like~ "*\\\\*" or
process.command_line : ("*10.*", "*172.1[6-9].*", "*172.2*", "*172.3[01].*", "*192.168.*")
)
) or
/* Branch C: Executables dropped via SMB by System process */
(
event.category == "file" and event.type == "creation" and
process.name == "System" and
file.extension in~ ("exe", "dll", "ps1", "bat", "cmd", "vbs", "hta", "js", "msi", "scr", "cpl") and
file.path like~ ("*\\Windows\\Temp\\*", "*\\Windows\\System32\\*", "*\\Windows\\SysWOW64\\*", "*\\ProgramData\\*", "*\\Users\\Public\\*")
)
)
]Detects lateral tool transfer via three branches: LOLBins (certutil, bitsadmin, esentutl, robocopy) executing with UNC paths or transfer-specific flags; known transfer tools (psexec, scp, sftp, winscp) referencing internal RFC1918 addresses or UNC paths; and executables dropped to sensitive directories by the System process (indicating SMB-based file drop). Covers BlackCat, Netwalker, Emotet, and Volt Typhoon TTPs.
Data Sources
Required Tables
False Positives & Tuning
- System administrators using robocopy or psexec for legitimate software deployment to remote hosts via UNC paths
- Backup and file sync agents (e.g., Veeam, Acronis) running as SYSTEM and writing executables to ProgramData or Temp directories
- IT automation tools (SCCM, PDQ Deploy, Ansible) using certutil or bitsadmin for software distribution across endpoints
- Security scanning products using psexec or similar tools for remote assessment tasks
Other platforms for T1570
Testing Methodology
Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Copy Executable to Remote ADMIN$ Share via SMB
Expected signal: Sysmon Event ID 1: cmd.exe with CommandLine containing '\\127.0.0.1\ADMIN$'. Sysmon Event ID 11 on the destination (localhost): FileCreated event for lateral_calc_test.exe in C:\Windows\Temp\ with Image=System (PID 4) — this is the SMB server process creating the file. Windows Security Event ID 5145 if object access auditing enabled: network share access to ADMIN$ from localhost.
- Test 2LOLBin Transfer via Certutil URL Cache to UNC Path Staging
Expected signal: Sysmon Event ID 1: certutil.exe with CommandLine containing '-urlcache', '-split', '-f', and the destination path. Sysmon Event ID 3: outbound network connection to 127.0.0.1:8080 (connection refused, but the attempt is logged). Windows Security Event ID 4688 if process command line auditing is enabled.
- Test 3BITSAdmin SMB File Transfer Between Internal Hosts
Expected signal: Sysmon Event ID 1: bitsadmin.exe with CommandLine containing '/transfer', 'LateralMoveJob', '/download', and the UNC source path '\\127.0.0.1\C$'. Sysmon Event ID 11: FileCreated for bits_lateral_test.exe in C:\Windows\Temp\. Sysmon Event ID 3: SMB connection to 127.0.0.1:445 from bitsadmin process. BITS Event ID 59 in Microsoft-Windows-Bits-Client/Operational log: job transfer started.
- Test 4Esentutl File Copy to Remote Share
Expected signal: Sysmon Event ID 1: esentutl.exe with CommandLine containing '/cp' and the source/destination paths. Sysmon Event ID 11: FileCreated for esentutl_lateral_test.exe in C:\Windows\Temp\, with Image=esentutl.exe as the initiating process. Windows Security Event ID 4688 if process auditing enabled.
- Test 5SCP Lateral File Transfer to Internal Host
Expected signal: Linux auditd EXECVE record: scp with arguments including the destination IP 192.168.1.100. Syslog entry from the SSH client showing connection attempt. On macOS: unified log entry from com.openssh.sshd. If Sysmon for Linux is deployed: ProcessCreate event for scp with CommandLine containing the internal IP.
References (14)
- https://attack.mitre.org/techniques/T1570/
- https://lolbas-project.github.io/lolbas/Binaries/Certutil/
- https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/
- https://lolbas-project.github.io/lolbas/Binaries/Esentutl/
- https://unit42.paloaltonetworks.com/born-this-way-origins-of-lockergoga/
- https://news.sophos.com/en-us/2020/05/27/netwalker-fileless-ransomware-injected-via-reflective-loading/
- https://www.microsoft.com/security/blog/2022/06/13/the-many-lives-of-blackcat-ransomware/
- https://www.secureworks.com/research/bronze-silhouette-activity-and-threat-intelligence
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1570/T1570.md
- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/bitsadmin-transfer
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-devicefileevents-table
- https://learn.microsoft.com/en-us/sysinternals/downloads/psexec
- https://www.huntress.com/blog/analyzing-inc-ransom
- https://symantec-enterprise-blogs.security.com/threat-intelligence/medusa-ransomware
Unlock Pro Content
Get the full detection package for T1570 including response playbook, investigation guide, and atomic red team tests.