ATT&CK T1570 - Internal HTTP File Transfer (Possible Tool Drop)

Darshan Thummar@Mighty

•updated Jun 10, 2026•1•0•8

This rule detects internal HTTP file transfers using the PUT method, specifically looking for executable files (identified by the 'MZ' header) being transferred. This behavior is indicative of a possible tool drop within a network, aligning with the MITRE ATT&CK technique T1570 (Lateral Movement - Internal HTTP File Transfer). The rule focuses on traffic within the home network, suggesting an internal adversary or compromised host attempting to move malicious tools.