value: Adversaries may transfer tools or other files between systems in a compromised environment. Files may be copied from one system to another to stage adversary tools or other files over the course of an operation. Adversaries may copy files laterally between internal victim systems to support lateral movement using inherent file sharing protocols such as file sharing over SMB to connected network shares or with authenticated connections with [SMB/Windows Admin Shares](T1021.002) or [Remote Desktop Protocol](T1021.001). Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
name: Lateral Tool Transfer