Lateral Tool Transfer

Attackers copy their tools from one host they control to another inside the network, so they can run them there. It is a technique under the Lateral Movement tactic. Copying a program onto a new host usually comes just before running it there, so catching the copy can stop the next step.

On Windows the attacker writes a program or script to another host's file shares, often the administrative shares that every Windows host has, using built-in copy commands or a remote management tool. On Linux they use secure copy or a shared folder. Then they run what they copied, through a service, a scheduled job or a remote command.

Data source: Windows Security events on the receiving host; Windows process creation events on the sending host

{
  "host": {
    "name": "srv-418.corp.example"
  },
  "event": {
    "code": "5145"
  },
  "source": {
    "ip": "192.0.2.77"
  },
  "winlog": {
    "event_data": {
      "ShareName": "\\\\*\\C$",
      "SubjectUserName": "m.castell",
      "RelativeTargetName": "Svc\\k7agent.exe"
    }
  },
  "@timestamp": "2026-06-02T14:21:09.733Z"
}

Prebuilt Elastic rule: Remote File Copy to a Hidden Share

5145 is recorded only when Audit Detailed File Share is on, and it is high volume. Start with program files written to shares: event.code: 5145 and winlog.event_data.RelativeTargetName: (*.exe or *.dll or *.ps1 or *.bat). Then check whether the same file started on that host soon afterward. Look for writes to administrative shares from workstations, the same file copied to several hosts within minutes, and copies made by an account that doesn't deploy software.

Software deployment tools, patching systems and administrators copy programs to other hosts all the time. Check whether the source is a known deployment server, whether the file matches a known package, and whether the account belongs to IT. A program copied from an ordinary workstation and run straight away is rarely routine.

The log events that help detect this technique, from the Telemetry reference: which log source to collect, which event in it, and how to enable each one.

• ESXi and vCenter logs (the log as a whole)
• Linux audit framework (auditd) (the log as a whole)
• macOS unified log (the log as a whole)
• Windows Security event log
  • 5140 A network share object was accessed.
• Sysmon
  • 1 Process creation
  • 11 FileCreate

• MITRE ATT&CK, Lateral Tool Transfer
• Microsoft Learn, 5145(S, F): A network share object was checked to see whether client can be granted desired access

No range covers this technique yet; the write-up above landed first. Ranges are added continuously; the ones live today are on the training ladder.