Lateral Tool Transfer
Adversaries may transfer tools or other files between systems in a compromised environment. Files may be copied from one system to another to stage adversary tools or other files over the course of an operation. Adversaries may copy files laterally between internal victim systems to support lateral movement using inherent file sharing protocols such as file sharing over SMB to connected network shares or with authenticated connections with SMB/Windows Admin Shares or Remote Desktop Protocol. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Procedure Examples
| Name | Description |
|---|---|
| APT32 |
APT32 has deployed tools after moving laterally using administrative accounts.[18] |
| BITSAdmin |
BITSAdmin can be used to create BITS Jobs to upload and/or download files from SMB file servers.[5] |
| cmd |
cmd can be used to copy files to/from a remotely connected internal system.[3] |
| DustySky |
DustySky searches for network drives and removable media and duplicates itself onto them.[8] |
| esentutl |
esentutl can be used to copy files to/from a remote share.[6] |
| Expand |
Expand can be used to download or upload a file over a network share.[4] |
| FIN10 |
FIN10 has deployed Meterpreter stagers and SplinterRAT instances in the victim network after moving laterally.[14] |
| LockerGoga |
LockerGoga has been observed moving around the victim network via SMB, indicating the actors behind this ransomware are manually copying files form computer to computer instead of self-propagating.[11] |
| Netwalker |
Operators deploying Netwalker have used psexec to copy the Netwalker payload across accessible systems.[13] |
| Olympic Destroyer |
Olympic Destroyer attempts to copy itself to remote machines on the network.[9] |
| PsExec |
PsExec can be used to download or upload a file over a network share.[7] |
| Shamoon |
Shamoon attempts to copy itself to remote machines on the network.[12] |
| Turla |
Turla RPC backdoors can be used to transfer files to/from victim machines on the local network.[15][16] |
| WannaCry |
WannaCry attempts to copy itself to remote computers after gaining access via an SMB exploit.[10] |
| Wizard Spider |
Wizard Spider has used stolen credentials to copy tools into the |
Mitigations
| Mitigation | Description |
|---|---|
| Filter Network Traffic |
Consider using the host firewall to restrict file sharing communications such as SMB. [2] |
| Network Intrusion Prevention |
Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware or unusual data transfer over known tools and protocols like FTP can be used to mitigate activity at the network level. Signatures are often for unique indicators within protocols and may be based on the specific obfuscation technique used by a particular adversary or tool, and will likely be different across various malware families and versions. [1] |
Detection
Monitor for file creation and files transferred within a network using protocols such as SMB. Unusual processes with internal network connections creating files on-system may be suspicious. Consider monitoring for abnormal usage of utilities and command-line arguments that may be used in support of remote transfer of files. Considering monitoring for alike file hashes or characteristics (ex: filename) that are created on multiple hosts.
References
- Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.
- Microsoft. (2020, March 10). Preventing SMB traffic from lateral connections and entering or leaving the network. Retrieved June 1, 2020.
- Microsoft. (n.d.). Copy. Retrieved April 26, 2016.
- LOLBAS. (n.d.). Expand.exe. Retrieved February 19, 2019.
- Microsoft. (2019, July 12). About BITS. Retrieved March 16, 2020.
- LOLBAS. (n.d.). Esentutl.exe. Retrieved September 3, 2019.
- Russinovich, M. (2004, June 28). PsExec. Retrieved December 17, 2015.
- ClearSky. (2016, January 7). Operation DustySky. Retrieved January 8, 2016.
- Mercer, W. and Rascagneres, P. (2018, February 12). Olympic Destroyer Takes Aim At Winter Olympics. Retrieved March 14, 2019.
- Noerenberg, E., Costis, A., and Quist, N. (2017, May 16). A Technical Analysis of WannaCry Ransomware. Retrieved March 25, 2019.
- Harbison, M.. (2019, March 26). Born This Way? Origins of LockerGoga. Retrieved April 16, 2019.
- Falcone, R.. (2016, November 30). Shamoon 2: Return of the Disttrack Wiper. Retrieved January 11, 2017.
- Szappanos, G., Brandt, A.. (2020, May 27). Netwalker ransomware tools give insight into threat actor. Retrieved May 27, 2020.
- FireEye iSIGHT Intelligence. (2017, June 16). FIN10: Anatomy of a Cyber Extortion Operation. Retrieved June 25, 2017.
- Faou, M. and Dumont R.. (2019, May 29). A dive into Turla PowerShell usage. Retrieved June 14, 2019.
- Symantec DeepSight Adversary Intelligence Team. (2019, June 20). Waterbug: Espionage Group Rolls Out Brand-New Toolset in Attacks Against Governments. Retrieved July 8, 2019.
- John, E. and Carvey, H. (2019, May 30). Unraveling the Spiderweb: Timelining ATT&CK Artifacts Used by GRIM SPIDER. Retrieved May 12, 2020.
- Dahan, A. (2017). Operation Cobalt Kitty. Retrieved December 27, 2018.