MITRE ATT&CK technique
Lateral Tool Transfer detection rulesT1570
Lateral Tool Transfer (T1570) is a MITRE ATT&CK technique in the Lateral Movement tactic. This page lists the 6 community-maintained Sigma detection rules in the library mapped to T1570 and its sub-techniques. Each rule includes its detection logic, log source, false positives and original YAML. These rules mainly target windows.
Top products
Tactic
Metasploit Or Impacket Service Installation Via SMB PsExec
highDetects usage of Metasploit SMB PsExec (exploit/windows/smb/psexec) and Impacket psexec.py by triggering on specific service installation
windows
PSEXEC Remote Execution File Artefact
highDetects creation of the PSEXEC key file. Which is created anytime a PsExec command is executed. It gets written to the file system and will be recorded in the USN Journal on the target system
windows · file_event
Rundll32 Execution Without Parameters
highDetects rundll32 execution without parameters as observed when running Metasploit windows/smb/psexec exploit module
windows · process_creation
Potentially Suspicious File Creation by OpenEDR's ITSMService
mediumDetects the creation of potentially suspicious files by OpenEDR's ITSMService process. The ITSMService is responsible for remote management operations and can create files on the system through the Process Explorer or file management features. While legitimate for IT operations, creation of executable or script files could indicate unauthorized file uploads, data staging, or malicious file deployment.
windows · file_event
SMB over QUIC Via Net.EXE
mediumDetects the mounting of Windows SMB shares over QUIC, which can be an unexpected event in some enterprise environments.
windows · process_creation
SMB over QUIC Via PowerShell Script
mediumDetects the mounting of Windows SMB shares over QUIC, which can be an unexpected event in some enterprise environments
windows · ps_script