Lateral Tool Transfer - Common Utilities
Detects lateral tool transfer activities using common utilities like scp, rsync, wget, or curl, combined with an IP address in the command line and a script/executable file. This pattern is often indicative of an attacker moving tools between compromised systems.
Sigma
