This documentation contains work-in-progress information for future Elastic Stack and Cloud releases. Use the version selector to view supported release docs. It also contains some Elastic Cloud serverless information. Check out our serverless docs for more details.

« Incoming DCOM Lateral Movement with ShellBrowserWindow or ShellWindows Incoming Execution via WinRM Remote Shell »

› ›

Lateral Tool Transfer

edit

Lateral Tool Transfer

edit

Identifies the creation or change of a Windows executable file over network shares. Adversaries may transfer tools or other files between systems in a compromised environment.

Rule type: eql

Rule indices:

logs-endpoint.events.*
winlogbeat-*
logs-windows.*

Severity: medium

Risk score: 47

Runs every: 5m

Searches indices from: now-9m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References: None

Tags:

Elastic
Host
Windows
Threat Detection
Lateral Movement

Version: 3

Rule authors:

Elastic

Rule license: Elastic License v2

Rule query

edit

sequence by host.id with maxspan=30s
  [network where event.type == "start" and process.pid == 4 and destination.port == 445 and
   network.direction : ("incoming", "ingress") and network.transport == "tcp" and
   source.address != "127.0.0.1" and source.address != "::1"
  ] by process.entity_id
  /* add more executable extensions here if they are not noisy in your environment */
  [file where event.type in ("creation", "change") and process.pid == 4 and file.extension : ("exe", "dll", "bat", "cmd")] by process.entity_id

Framework: MITRE ATT&CK^TM

Tactic:
- Name: Lateral Movement
- ID: TA0008
- Reference URL: https://attack.mitre.org/tactics/TA0008/
Technique:
- Name: Lateral Tool Transfer
- ID: T1570
- Reference URL: https://attack.mitre.org/techniques/T1570/

« Incoming DCOM Lateral Movement with ShellBrowserWindow or ShellWindows Incoming Execution via WinRM Remote Shell »