Before an adversary can affect a physical process, the tools that do it have to be copied onto the hosts and devices that can reach the controllers. MITRE ATT&CK for ICS tracks this as T0867 Lateral Tool Transfer, a Lateral Movement technique for Windows, Linux and embedded assets. ATT&CK describes adversaries copying tools or files between systems inside the victim network, often over SMB file sharing, and notes that malware uses SMB and other file sharing protocols to move through industrial networks. The general behaviour mirrors Enterprise T1570, covered in the MITRE ATT&CK T1570 Lateral Tool Transfer guide. This page covers what is OT-specific: the public cases, transfers to field devices, MITRE's OT detections and the controls that limit file movement between zones.
Key takeaways
- Tool transfer is a late, high-value warning. In the Ukraine and Triton campaigns ATT&CK records tools being moved inside the ICS network shortly before or during the operation.
- Commodity worms do it too. ATT&CK records NotPetya, WannaCry and Bad Rabbit moving through industrial networks over SMB.
- Field devices are destinations. INCONTROLLER can load an implant on Omron PLCs over Telnet, and MITRE's embedded analytic watches file transfers to field devices from unapproved sources.
- Allowlist who may write executables. MITRE's analytics rely on a list of authorised file sources and engineering workstations; build that list first.
- Restrict SMB between zones. File sharing between OT hosts and across zones should be the exception, through defined conduits.
Procedure examples in ATT&CK for ICS
| Campaign or software | What ATT&CK records |
|---|---|
| 2015 Ukraine Electric Power Attack (C0028) | Sandworm Team moved its tools laterally within the ICS network |
| 2016 Ukraine Electric Power Attack (C0025) | Sandworm Team used a VBS script to copy ICS-specific payloads during the Industroyer operation |
| Triton Safety Instrumented System Attack (C0030) | TEMP.Veles attempted to transfer and execute the WMImplant tool on multiple victim machines |
| INCONTROLLER (S1045) | Can use a Telnet session to load a malware implant on Omron PLCs |
| Stuxnet (S0603) | Inserted a binary representation of its main DLL into a database table using an SQL statement |
| NotPetya (S0368), WannaCry (S0366), Bad Rabbit (S0606) | Move laterally through industrial networks by means of the SMB service |
For background on these families see the ICS Malware History Guide; for Triton's target, the Safety Instrumented Systems Security Guide.
What is different in OT
- Legitimate transfers are routine: engineering workstations push project files and firmware, historians pull data, and vendors deploy patches. Detection must know the approved sources or it drowns in noise.
- Destinations include controllers: transfers can go to PLCs and field devices through engineering protocols or services such as Telnet and protocol file services, not only Windows shares.
- Agents are limited: many HMIs and embedded devices cannot run endpoint tools, so network monitoring carries more of the load.
- Older services persist: legacy equipment may still depend on file sharing, FTP or Telnet, which gives worms such as those in the table more paths to follow.
Controls that limit tool transfer
| Control | Source | OT implementation |
|---|---|---|
| Network intrusion detection and prevention (M0931) | MITRE: signatures for adversary malware and unusual transfer over known tools and protocols such as FTP | OT-aware monitoring sensors at zone boundaries and on key control segments |
| Zone and conduit file rules | NHI Mgmt Group recommendation | Allow SMB and file transfer only between named hosts across defined conduits; deny host-to-host SMB inside HMI and operator zones where not needed. See the OT Network Segmentation, Purdue Model and IEC 62443 Zones and Conduits Guide |
| Application allowlisting | NHI Mgmt Group recommendation | Transferred tools fail to run if only approved binaries may execute; see the Application Allowlisting Guide |
| Disable unused services on devices | NHI Mgmt Group recommendation | Turn off Telnet, FTP and file services on controllers where the vendor supports it; restrict the rest to engineering workstations. See the PLC Security Guide |
| Restrict administrative shares | NHI Mgmt Group recommendation | Limit remote administrative share access to OT administration hosts and accounts |
Detection and measurement
ATT&CK for ICS v20 detection strategy DET0745 gives three analytics. Each is gated to alert only when execution breaks an approved signer, hash, path or tool allowlist, or comes from an unauthorised user or tool, and suppresses vendor-signed software, approved engineering utilities, patching, backup and documented maintenance.
| Platform | Signal (from MITRE's analytics) | Log source |
|---|---|---|
| Windows | An executable or script written to an ICS host from a remote share by a source not on the authorised list, then executed from the same path within a short window | Windows Security event 5145 (and 5140); Sysmon event 11 (file create) then event 1 (process create) |
| Linux | An executable placed by scp, sftp, rsync or similar on an ICS Linux asset, then executed by a user outside the approved administration baseline | auditd SYSCALL and PATH records |
| Embedded | A file transfer to a field device from a source not on the engineering workstation list, where the file looks like firmware or an executable outside the device's normal exchange profile | OT protocol decoder for DNP3 or IEC 61850 file transfer |
Event 5145 sits in the Windows "Audit Detailed File Share" subcategory and is logged for every network share object access, so enable it on OT servers and engineering workstations and filter for write access and executable file types. The analytic's tunable lists (authorised file sources, engineering workstation list, suspicious file patterns, transfer window) are the core of the work. See the OT Network Security Monitoring Guide and the OT Security Operations Centre Guide.
Metrics:
- Percentage of OT Windows hosts with Detailed File Share auditing and Sysmon process and file events forwarded.
- Number of hosts allowed to write executables to OT assets, reviewed quarterly.
- Executable transfers from unapproved sources per month, and time to triage.
- Percentage of controllers with unused file and remote shell services disabled.
Rolling out detection
- Baseline: monitor file transfers for several weeks to learn which hosts legitimately move executables, firmware and project files.
- Build the lists: write the authorised source and engineering workstation lists from the baseline, with owners.
- Alert, do not block: start with detection only; blocking SMB between OT hosts can stop historians or vendor tools.
- Tighten conduits: remove unneeded file sharing paths in maintenance windows, one zone at a time, with a tested way to restore a rule if a process function fails.
- Review: revisit the lists after every project, vendor change or new engineering workstation.
Responding to an unexpected transfer
- Preserve the file and its source: hash and keep the transferred file; record the source host and account.
- Find the other copies: search transfer logs and flow records for the same file or source reaching other hosts and devices.
- Check device logic: where a field device received a file, compare its program and firmware with the approved version, coordinating with operations before any change.
- Contain the source: isolate the sending host through agreed procedures; it is often an engineering workstation that operators rely on.
Follow the OT Incident Response Guide.
Where identity fits
Tool transfer over SMB and remote services needs credentials, often a domain or local administrator account shared across OT hosts, or a service account used for backups and patching. Use unique local administrator passwords per host, restrict which accounts can write to administrative shares, and watch service accounts writing executables outside their normal schedule. See the Non-Human Identities in OT Guide.
Framework mapping
| Framework | Reference | Relevance |
|---|---|---|
| MITRE ATT&CK for ICS v20 | T0867; M0931; DET0745 | Technique, mapped mitigation and detection strategy |
| MITRE ATT&CK Enterprise v20 | T1570 Lateral Tool Transfer | Enterprise equivalent |
| NIST SP 800-53 Rev. 5 | SC-7 Boundary Protection; CM-7 Least Functionality; SI-4 System Monitoring; SI-3 Malicious Code Protection | Conduits, disabled services, monitoring and anti-malware |
| NIST CSF 2.0 | DE.CM-01; DE.CM-09 | Network and host monitoring |
Common failure patterns
- Flat file sharing. Every OT host can write to every other host's shares, so a worm reaches the whole plant.
- Detection with no allowlist. Without a list of approved sources, file transfer alerts are ignored within weeks.
- Controllers left with Telnet and FTP on. Unused services become a delivery route for implants.
- Shared administrator passwords. One credential lets tools move to every Windows host.
- Watching Windows only. Transfers to field devices need protocol-aware network monitoring.
Practitioner checklist
- Document which hosts may send executables, firmware and project files to which OT assets.
- Enable Detailed File Share auditing and Sysmon on OT Windows servers and workstations.
- Alert on executables written from unapproved sources and run soon after.
- Monitor DNP3 and IEC 61850 file transfers to field devices from non-engineering sources.
- Restrict SMB between OT hosts and across zones to defined conduits.
- Disable unused Telnet, FTP and file services on controllers.
- Use unique local administrator passwords on OT hosts.
- Run application allowlisting on HMIs and engineering workstations.
Standards and references
- MITRE ATT&CK: Lateral Tool Transfer (ICS)
- MITRE ATT&CK: Lateral Tool Transfer (Enterprise)
- MITRE ATT&CK: 2016 Ukraine Electric Power Attack
- MITRE ATT&CK: INCONTROLLER
- Microsoft Learn: Event 5145, a network share object was checked
- NIST: SP 800-53 Rev. 5
Related NHI Mgmt Group resources: MITRE ATT&CK T1570 Lateral Tool Transfer · Lateral Movement Guide · MITRE ATT&CK for ICS Guide · OT Ransomware Response Playbook · ATT&CK for ICS T0886 Remote Services · ATT&CK for ICS T0866 Exploitation of Remote Services