ATT&CK T1570 - Internal HTTP File Transfer (Possible Tool Drop)

nomit vyas@xoxo

•updated Jun 24, 2026•0•0•2

This rule detects internal HTTP PUT requests that contain the 'MZ' header, which is indicative of an executable file. This combination suggests a possible lateral movement scenario where an attacker is transferring a tool or malware within the internal network using HTTP PUT.