Remote File Copy

From attackics
Jump to navigation Jump to search
Remote File Copy
Technique
ID T867
Tactic Lateral Movement
Data Sources File monitoring, Packet capture, Process use of network, Process monitoring, Netflow/Enclave netflow, Network protocol analysis
Asset Human-Machine Interface, Control Server, Data Historian

Description

Adversaries may copy files from one system to another to stage adversary tools or other files over the course of an operation.1 Copying of files may also be performed laterally between internal victim systems to support Lateral Movement with remote Execution using inherent file sharing protocols such as file sharing over SMB to connected network shares.1

In control systems environments, malware may use SMB and other file sharing protocols to move laterally through industrial networks.


Procedure Examples

  • Bad Rabbit can move laterally through industrial networks by means of the SMB service.2
  • NotPetya can move laterally through industrial networks by means of the SMB service.2
  • WannaCry can move laterally through industrial networks by means of the SMB service.2