Lateral Tool Transfer Hunt

Danny Y@zendannyy

•updated Feb 25, 2026•12•0•132

This rule detects attempts to transfer tools or other files between systems in a compromised environment using common utilities like scp, rsync, wget, or curl. This rule should be used for hunting in your environment.