T1570 Lateral Tool Transfer via SMB Admin Shares

Arnold Chan@slaz

•updated Sep 8, 2026•0•0•2

This rule detects potential lateral movement activity by identifying executable or script files being written to administrative shares (C$ or ADMIN$) followed by the execution of a file with the same name on the destination device within 15 minutes. It includes logic to filter out known deployment/patch management service accounts and file names to reduce noise.