Detect Lateral Tool Transfer in CrowdStrike LogScale
Adversaries may transfer tools or other files between systems in a compromised environment. Once initial access is established, tools are staged across multiple hosts to support lateral movement, ransomware deployment, data exfiltration, or persistence. Transfer mechanisms include SMB via Windows Admin Shares (\\host\ADMIN$, \\host\C$), RDP file sharing, and native utilities such as scp, rsync, sftp, ftp, and curl. Living-Off-The-Land Binaries (LOLBins) including certutil, bitsadmin, esentutl, and robocopy are frequently abused to perform transfers while blending with legitimate activity. PsExec is widely used to copy and remotely execute binaries on target hosts. Real-world threat actors including BlackCat ransomware (psexec-based propagation), Netwalker (psexec), INC Ransomware (push to multiple endpoints), Medusa Group (PDQ Deploy for binary distribution), Emotet (network self-replication via service.exe), and Volt Typhoon (web shell replication across servers) have leveraged these techniques to propagate tools during intrusions.
MITRE ATT&CK
- Tactic
- Lateral Movement
- Technique
- T1570 Lateral Tool Transfer
- Canonical reference
- https://attack.mitre.org/techniques/T1570/
LogScale Detection Query
// Branch A: LOLBin lateral transfers
#repo=base_sensor #event_simpleName=ProcessRollup2
| ImageFileName = /(?i)(certutil|bitsadmin|esentutl|robocopy|expand|makecab)\.exe$/
| CommandLine = /(?i)(urlcache|\/transfer|\/addfile|\/upload|\/cp\b|\/y\b|\\\\[a-zA-Z0-9\-\.]+\\)/
| DetectionBranch := "LOLBin_Transfer"
| FileName := ImageFileName
| groupBy([aid, ComputerName, UserName, FileName, CommandLine, ParentBaseFileName, DetectionBranch], function=count(aid, as=EventCount))
// Branch B: Transfer tools referencing internal hosts
| union (
#repo=base_sensor #event_simpleName=ProcessRollup2
| ImageFileName = /(?i)(psexec|psexec64|paexec|scp|sftp|winscp|ftp)\.exe$/
| CommandLine = /(?i)(\\\\[a-zA-Z]|(?:10\.|172\.(?:1[6-9]|2[0-9]|3[01])\.|192\.168\.))/
| DetectionBranch := "Transfer_Tool"
| FileName := ImageFileName
| groupBy([aid, ComputerName, UserName, FileName, CommandLine, ParentBaseFileName, DetectionBranch], function=count(aid, as=EventCount))
)
// Branch C: SMB executable drops via System process
| union (
#repo=base_sensor #event_simpleName=PeFileWritten
| TargetFileName = /(?i)\.(exe|dll|ps1|bat|cmd|vbs|hta|js|msi|scr|cpl)$/
| TargetFileName = /(?i)\\(Windows\\Temp|Windows\\System32|Windows\\SysWOW64|ProgramData|Users\\Public)\\/
| ImageFileName = /(?i)(^|\\)System\.exe$/
| DetectionBranch := "SMB_Executable_Drop"
| FileName := TargetFileName
| groupBy([aid, ComputerName, UserName, FileName, TargetFileName, DetectionBranch], function=count(aid, as=EventCount))
)
| sort(EventCount, order=desc)CrowdStrike LogScale (CQL) query across Falcon sensor events detecting lateral tool transfer via: ProcessRollup2 events matching LOLBin executables (certutil, bitsadmin, esentutl, robocopy) with transfer-indicative command-line arguments or UNC path references; ProcessRollup2 events for known transfer tools (psexec, scp, sftp, winscp) targeting RFC1918 addresses or UNC admin shares; and PeFileWritten events where the System process drops PE/script files into sensitive directories, indicating SMB-staged lateral file transfers. Results are grouped by host and aggregated by event count.
Data Sources
Required Tables
False Positives & Tuning
- Authorized system administrators using certutil for WSUS certificate validation or PKI tasks that include UNC path arguments
- Legitimate IT automation (Ansible, SCCM, PDQ) invoking psexec or robocopy for managed software rollout to internal endpoints
- Security teams conducting authorized red team or vulnerability assessment exercises using psexec or scp against internal RFC1918 targets
- Windows Installer or trusted update mechanisms using the SYSTEM process to write updated binaries to System32 or ProgramData directories
Other platforms for T1570
Testing Methodology
Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Copy Executable to Remote ADMIN$ Share via SMB
Expected signal: Sysmon Event ID 1: cmd.exe with CommandLine containing '\\127.0.0.1\ADMIN$'. Sysmon Event ID 11 on the destination (localhost): FileCreated event for lateral_calc_test.exe in C:\Windows\Temp\ with Image=System (PID 4) — this is the SMB server process creating the file. Windows Security Event ID 5145 if object access auditing enabled: network share access to ADMIN$ from localhost.
- Test 2LOLBin Transfer via Certutil URL Cache to UNC Path Staging
Expected signal: Sysmon Event ID 1: certutil.exe with CommandLine containing '-urlcache', '-split', '-f', and the destination path. Sysmon Event ID 3: outbound network connection to 127.0.0.1:8080 (connection refused, but the attempt is logged). Windows Security Event ID 4688 if process command line auditing is enabled.
- Test 3BITSAdmin SMB File Transfer Between Internal Hosts
Expected signal: Sysmon Event ID 1: bitsadmin.exe with CommandLine containing '/transfer', 'LateralMoveJob', '/download', and the UNC source path '\\127.0.0.1\C$'. Sysmon Event ID 11: FileCreated for bits_lateral_test.exe in C:\Windows\Temp\. Sysmon Event ID 3: SMB connection to 127.0.0.1:445 from bitsadmin process. BITS Event ID 59 in Microsoft-Windows-Bits-Client/Operational log: job transfer started.
- Test 4Esentutl File Copy to Remote Share
Expected signal: Sysmon Event ID 1: esentutl.exe with CommandLine containing '/cp' and the source/destination paths. Sysmon Event ID 11: FileCreated for esentutl_lateral_test.exe in C:\Windows\Temp\, with Image=esentutl.exe as the initiating process. Windows Security Event ID 4688 if process auditing enabled.
- Test 5SCP Lateral File Transfer to Internal Host
Expected signal: Linux auditd EXECVE record: scp with arguments including the destination IP 192.168.1.100. Syslog entry from the SSH client showing connection attempt. On macOS: unified log entry from com.openssh.sshd. If Sysmon for Linux is deployed: ProcessCreate event for scp with CommandLine containing the internal IP.
References (14)
- https://attack.mitre.org/techniques/T1570/
- https://lolbas-project.github.io/lolbas/Binaries/Certutil/
- https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/
- https://lolbas-project.github.io/lolbas/Binaries/Esentutl/
- https://unit42.paloaltonetworks.com/born-this-way-origins-of-lockergoga/
- https://news.sophos.com/en-us/2020/05/27/netwalker-fileless-ransomware-injected-via-reflective-loading/
- https://www.microsoft.com/security/blog/2022/06/13/the-many-lives-of-blackcat-ransomware/
- https://www.secureworks.com/research/bronze-silhouette-activity-and-threat-intelligence
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1570/T1570.md
- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/bitsadmin-transfer
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-devicefileevents-table
- https://learn.microsoft.com/en-us/sysinternals/downloads/psexec
- https://www.huntress.com/blog/analyzing-inc-ransom
- https://symantec-enterprise-blogs.security.com/threat-intelligence/medusa-ransomware
Unlock Pro Content
Get the full detection package for T1570 including response playbook, investigation guide, and atomic red team tests.