Detect Lateral Tool Transfer in Splunk
Adversaries may transfer tools or other files between systems in a compromised environment. Once initial access is established, tools are staged across multiple hosts to support lateral movement, ransomware deployment, data exfiltration, or persistence. Transfer mechanisms include SMB via Windows Admin Shares (\\host\ADMIN$, \\host\C$), RDP file sharing, and native utilities such as scp, rsync, sftp, ftp, and curl. Living-Off-The-Land Binaries (LOLBins) including certutil, bitsadmin, esentutl, and robocopy are frequently abused to perform transfers while blending with legitimate activity. PsExec is widely used to copy and remotely execute binaries on target hosts. Real-world threat actors including BlackCat ransomware (psexec-based propagation), Netwalker (psexec), INC Ransomware (push to multiple endpoints), Medusa Group (PDQ Deploy for binary distribution), Emotet (network self-replication via service.exe), and Volt Typhoon (web shell replication across servers) have leveraged these techniques to propagate tools during intrusions.
MITRE ATT&CK
- Tactic
- Lateral Movement
- Technique
- T1570 Lateral Tool Transfer
- Canonical reference
- https://attack.mitre.org/techniques/T1570/
SPL Detection Query
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" (EventCode=1 OR EventCode=11)
| eval IsCertutil=if(EventCode=1 AND match(lower(Image), "\\certutil\.exe$") AND (match(CommandLine, "(?i)(urlcache|/transfer|/cp)") OR match(CommandLine, "\\\\\\\\")), 1, 0)
| eval IsBitsadmin=if(EventCode=1 AND match(lower(Image), "\\bitsadmin\.exe$") AND match(lower(CommandLine), "(/transfer|/addfile|/upload)"), 1, 0)
| eval IsEsentutl=if(EventCode=1 AND match(lower(Image), "\\esentutl\.exe$") AND match(lower(CommandLine), "(/cp|/y)") AND match(CommandLine, "\\\\\\\\"), 1, 0)
| eval IsRobocopy=if(EventCode=1 AND match(lower(Image), "\\robocopy\.exe$") AND match(CommandLine, "\\\\\\\\"), 1, 0)
| eval IsPsExec=if(EventCode=1 AND match(lower(Image), "\\(psexec|psexec64|paexec)\.exe$") AND (match(CommandLine, "\\\\\\\\") OR match(CommandLine, "(?:10\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[01]\\.|192\\.168\\.)")), 1, 0)
| eval IsScpSftp=if(EventCode=1 AND match(lower(Image), "\\(scp|sftp|winscp|ftp)\.exe$") AND (match(CommandLine, "\\\\\\\\") OR match(CommandLine, "(?:10\\.|172\\.1[6-9]\\.|172\\.2[0-9]\\.|172\\.3[01]\\.|192\\.168\\.)")), 1, 0)
| eval IsSMBDrop=if(EventCode=11 AND match(lower(TargetFilename), "\.(exe|dll|ps1|bat|cmd|vbs|hta|msi|scr)$") AND match(TargetFilename, "(?i)\\(Windows\\Temp|Windows\\System32|Windows\\SysWOW64|ProgramData|Users\\Public)\\") AND (Image="System" OR match(Image, "\\\\System$")), 1, 0)
| where IsCertutil=1 OR IsBitsadmin=1 OR IsEsentutl=1 OR IsRobocopy=1 OR IsPsExec=1 OR IsScpSftp=1 OR IsSMBDrop=1
| eval DetectionMethod=case(IsSMBDrop=1, "SMB_Executable_Drop", IsCertutil=1, "Certutil_Transfer", IsBitsadmin=1, "BITSAdmin_Transfer", IsEsentutl=1, "Esentutl_Transfer", IsRobocopy=1, "Robocopy_Transfer", IsPsExec=1, "PsExec_Copy", IsScpSftp=1, "SCP_SFTP_Transfer", true(), "Unknown")
| eval TargetFile=coalesce(TargetFilename, Image)
| eval CmdLine=coalesce(CommandLine, "N/A")
| table _time, host, User, Image, CmdLine, TargetFile, DetectionMethod, ParentImage, ParentCommandLine
| sort - _timeDetects lateral tool transfer using Sysmon Event ID 1 (Process Create) and Event ID 11 (File Create). Seven detection branches cover certutil/bitsadmin/esentutl/robocopy LOLBin transfers, psexec/scp/sftp tool-based transfers, and executables written to sensitive staging directories via the System process (SMB remote write signature). Each event is classified into a DetectionMethod field to guide analyst triage. The eval chain allows OR-based detection across branches without duplicating events.
Data Sources
Required Sourcetypes
False Positives & Tuning
- SCCM/Microsoft Endpoint Configuration Manager pushes software to endpoints via SMB, causing the System process to create executables in ProgramData and Windows directories
- IT automation tools (Ansible WinRM, Chef, Puppet, PDQ Deploy) legitimately use robocopy, bitsadmin, and psexec for software distribution across managed hosts
- Backup agents (Veeam, Acronis, Commvault) use certutil and bitsadmin for scheduled transfer tasks and robocopy for file replication
- Developer workflows using scp or sftp to deploy build artifacts to internal staging or build servers
- Security tools (Tenable, Qualys, CrowdStrike) that copy assessment agents to remote hosts during scanning operations
Other platforms for T1570
Testing Methodology
Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Copy Executable to Remote ADMIN$ Share via SMB
Expected signal: Sysmon Event ID 1: cmd.exe with CommandLine containing '\\127.0.0.1\ADMIN$'. Sysmon Event ID 11 on the destination (localhost): FileCreated event for lateral_calc_test.exe in C:\Windows\Temp\ with Image=System (PID 4) — this is the SMB server process creating the file. Windows Security Event ID 5145 if object access auditing enabled: network share access to ADMIN$ from localhost.
- Test 2LOLBin Transfer via Certutil URL Cache to UNC Path Staging
Expected signal: Sysmon Event ID 1: certutil.exe with CommandLine containing '-urlcache', '-split', '-f', and the destination path. Sysmon Event ID 3: outbound network connection to 127.0.0.1:8080 (connection refused, but the attempt is logged). Windows Security Event ID 4688 if process command line auditing is enabled.
- Test 3BITSAdmin SMB File Transfer Between Internal Hosts
Expected signal: Sysmon Event ID 1: bitsadmin.exe with CommandLine containing '/transfer', 'LateralMoveJob', '/download', and the UNC source path '\\127.0.0.1\C$'. Sysmon Event ID 11: FileCreated for bits_lateral_test.exe in C:\Windows\Temp\. Sysmon Event ID 3: SMB connection to 127.0.0.1:445 from bitsadmin process. BITS Event ID 59 in Microsoft-Windows-Bits-Client/Operational log: job transfer started.
- Test 4Esentutl File Copy to Remote Share
Expected signal: Sysmon Event ID 1: esentutl.exe with CommandLine containing '/cp' and the source/destination paths. Sysmon Event ID 11: FileCreated for esentutl_lateral_test.exe in C:\Windows\Temp\, with Image=esentutl.exe as the initiating process. Windows Security Event ID 4688 if process auditing enabled.
- Test 5SCP Lateral File Transfer to Internal Host
Expected signal: Linux auditd EXECVE record: scp with arguments including the destination IP 192.168.1.100. Syslog entry from the SSH client showing connection attempt. On macOS: unified log entry from com.openssh.sshd. If Sysmon for Linux is deployed: ProcessCreate event for scp with CommandLine containing the internal IP.
References (14)
- https://attack.mitre.org/techniques/T1570/
- https://lolbas-project.github.io/lolbas/Binaries/Certutil/
- https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/
- https://lolbas-project.github.io/lolbas/Binaries/Esentutl/
- https://unit42.paloaltonetworks.com/born-this-way-origins-of-lockergoga/
- https://news.sophos.com/en-us/2020/05/27/netwalker-fileless-ransomware-injected-via-reflective-loading/
- https://www.microsoft.com/security/blog/2022/06/13/the-many-lives-of-blackcat-ransomware/
- https://www.secureworks.com/research/bronze-silhouette-activity-and-threat-intelligence
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1570/T1570.md
- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/bitsadmin-transfer
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-devicefileevents-table
- https://learn.microsoft.com/en-us/sysinternals/downloads/psexec
- https://www.huntress.com/blog/analyzing-inc-ransom
- https://symantec-enterprise-blogs.security.com/threat-intelligence/medusa-ransomware
Unlock Pro Content
Get the full detection package for T1570 including response playbook, investigation guide, and atomic red team tests.