This site has been deprecated in favor of and will remain in place until 11/1/22.

Lateral Tool Transfer

From attackics
Jump to navigation Jump to search

To visit this technique’s new page please go to and update your links to

Lateral Tool Transfer
ID T0867
Tactic Lateral Movement
Data Sources Command: Command Execution, File: File Creation, File: File Metadata, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Asset Human-Machine Interface, Control Server, Data Historian


Adversaries may transfer tools or other files from one system to another to stage adversary tools or other files over the course of an operation.1 Copying of files may also be performed laterally between internal victim systems to support Lateral Movement with remote Execution using inherent file sharing protocols such as file sharing over SMB to connected network shares.1

In control systems environments, malware may use SMB and other file sharing protocols to move laterally through industrial networks.

Procedure Examples

  • Sandworm Team used a VBS script to facilitate lateral tool transfer. The VBS script was used to copy ICS-specific payloads with the following command: cscript C:\Backinfo\ufn.vbs <TargetIP> “C:\Backinfo\101.dll” “C:\Delta\101.dll”2
  • Bad Rabbit can move laterally through industrial networks by means of the SMB service.3
  • NotPetya can move laterally through industrial networks by means of the SMB service.3
  • Stuxnet sends an SQL statement that creates a table and inserts a binary value into the table. The binary value is a hex string representation of the main Stuxnet DLL as an executable file (formed using resource 210) and an updated configuration data block.4
  • WannaCry can move laterally through industrial networks by means of the SMB service.3


  • Network Intrusion Prevention - Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware or unusual data transfer over known tools and protocols like FTP can be used to mitigate activity at the network level. Signatures are often for unique indicators within protocols and may be based on the specific obfuscation technique used by a particular adversary or tool and will likely be different across various malware families and versions. Adversaries will likely change tool C2 signatures over time or construct protocols in such a way as to avoid detection by common defensive tools.5