Cross-source coverage

T1105 / ATT&CK

Ingress Tool Transfer

398 rules · 362 families across 11 sources.

10 deprecated hidden · include 2 atomic-IOC hidden · include

From MITRE ATT&CK 19.2

Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp. Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer).

On Windows, adversaries may use various utilities to download tools, such as copy, finger, certutil, and PowerShell commands such as IEX(New-Object Net.WebClient).downloadString() and Invoke-WebRequest. On Linux and macOS systems, a variety of utilities also exist, such as curl, scp, sftp, tftp, rsync, finger, and wget. A number of these tools, such as wget, curl, and scp, also exist on ESXi. After downloading a file, a threat actor may attempt to verify its integrity by checking its hash value (e.g., via certutil -hashfile).

Adversaries may also abuse installers and package managers, such as yum or winget, to download tools to victim hosts. Adversaries have also abused file application features, such as the Windows search-ms protocol handler, to deliver malicious files to victims through remote file searches invoked by User Execution (typically after interacting with Phishing lures).

Files can also be transferred using various Web Services as well as native or otherwise present tools on the victim system. In some cases, adversaries may be able to leverage services that sync between a web-based and an on-premises client, such as Dropbox or OneDrive, to transfer files onto victim systems. For example, by compromising a cloud account and logging into the service's web portal, an adversary may be able to trigger an automatic syncing process that transfers the file onto the victim's machine.

Platforms
ESXi · Linux · macOS · Network Devices · Windows
Telemetry
WinEventLog:Sysmonauditd:SYSCALLiptables:LOGmacos:endpointsecuritymacos:unifiedlogesxi:hostdesxi:vmkernelNSM:Flowsnmp:syslog

How MITRE says to detect it DET0060

Detect Ingress Tool Transfers via Behavioral Chain

Windows Analytic 0165

Unusual or uncommon processes initiate network connections to external destinations followed by file creation (tools downloaded).

  • WinEventLog:Sysmon EventCode=3, 22
  • WinEventLog:Sysmon EventCode=11
  • WinEventLog:Sysmon EventCode=1

Linux Analytic 0166

Shell-based tools (curl, wget, scp) initiate connections to external domains followed by creation of executable files on disk.

  • auditd:SYSCALL connect, execve, write
  • auditd:SYSCALL file creation/modification
  • iptables:LOG TCP connections

macOS Analytic 0167

Process execution of curl or wget followed by a network connection and a file created in temporary or user-specific directories.

  • macos:endpointsecurity ES_EVENT_TYPE_NOTIFY_EXEC
  • macos:unifiedlog file write/create
  • macos:unifiedlog connection open

ESXi Analytic 0168

Command line interface or vCLI triggers remote transfer using wget or curl, writing files into datastore paths or local tmp directories.

  • esxi:hostd command execution
  • esxi:vmkernel file write

Network Devices Analytic 0169

Network device logs show anomalous inbound file transfers or uncharacteristic flows with high payload volume to network devices with storage or automation hooks.

  • NSM:Flow connection metadata
  • snmp:syslog firmware write/log event

View on attack.mitre.org ↗

Emerging Threats Open

88 rules · 56 families
Detection Severity Format
ET MALWARE Observed ClickFix Loader Inbound Critical Suricata
ET ATTACK_RESPONSE 123Stealer Payload Inbound High Suricata
ET ATTACK_RESPONSE ASP.NET Web BackDoor Webshell Title Banner Observed High Suricata
ET ATTACK_RESPONSE Braodo Loader Inbound High Suricata
ET ATTACK_RESPONSE ClickFix MSHTA Command Inbound High Suricata
ET ATTACK_RESPONSE ClickFix Obfuscated Payload Inbound High Suricata
ET ATTACK_RESPONSE ClickFix Related Payload Inbound High Suricata
ET ATTACK_RESPONSE ClickFix Webpage Inbound High Suricata
ET ATTACK_RESPONSE Crpx0 Ransomware Payload Inbound (Launcher) High Suricata
ET ATTACK_RESPONSE Crpx0 Ransomware Payload Inbound (Mac_pro_build) High Suricata

+ 78 more from Emerging Threats Open → showing the 10 highest-severity

SigmaHQ/sigma

86 rules
Detection Severity Format
Greenbug Espionage Group Indicators Critical Sigma
Pandemic Registry Key Critical Sigma
Axios NPM Compromise File Creation Indicators - Linux High Sigma
Axios NPM Compromise File Creation Indicators - MacOS High Sigma
Axios NPM Compromise Indicators - Linux High Sigma
Axios NPM Compromise Indicators - macOS High Sigma
Axios NPM Compromise Indicators - Windows High Sigma
Curl Download And Execute Combination High Sigma
File Download And Execution Via IEExec.EXE High Sigma
File Download From IP Based URL Via CertOC.EXE High Sigma

+ 76 more from SigmaHQ/sigma → showing the 10 highest-severity

elastic/protections-artifacts

67 rules
Detection Severity Format
Command Interpreter with IP Address Argument Undefined Elastic TOML
Curl Download and OsaScript Payload Execution via Node Undefined Elastic TOML
Curl Executable File Download via Osascript Undefined Elastic TOML
Curl Execution via Apple Installer Package Undefined Elastic TOML
Curl Execution via Application Shell Script Undefined Elastic TOML
Curl Execution via Automator Application Undefined Elastic TOML
Curl Execution via CommandLine Shell Script Undefined Elastic TOML
Curl Execution via Env Binary Undefined Elastic TOML
Curl Hidden Binary Modification via Osascript Undefined Elastic TOML
Curl HTTP Fetch Piped to Cmd or Node via Command Shell Undefined Elastic TOML

+ 57 more from elastic/protections-artifacts → showing the 10 highest-severity

elastic/detection-rules

64 rules
Detection Severity Format
Curl Execution via Shell Profile High Elastic TOML
File Creation, Execution and Self-Deletion in Suspicious Directory High Elastic TOML
GKE Pod Exec with Curl or Wget to HTTPS High Elastic TOML
Ingress Tool Transfer Followed by Execution and Deletion Detected via Defend for Containers High Elastic TOML
Kubernetes Pod Exec with Curl or Wget to HTTPS High Elastic TOML
Potential File Download via a Headless Browser High Elastic TOML
Potential Git CVE-2025-48384 Exploitation High Elastic TOML
Potential Remote Install via MsiExec High Elastic TOML
Potential THC Tool Downloaded High Elastic TOML
Potential Webshell Deployed via Apache Struts CVE-2023-50164 Exploitation High Elastic TOML

+ 54 more from elastic/detection-rules → showing the 10 highest-severity

splunk/security_content

42 rules
Detection Severity Format
BITSAdmin Download File Undefined SPL
Cisco Isovalent - Curl Execution With Insecure Flags Undefined SPL
Cisco NVM - Suspicious File Download via Headless Browser Undefined SPL
Cisco NVM - Webserver Download From File Sharing Website Undefined SPL
Cisco Secure Firewall - Communication Over Suspicious Ports Undefined SPL
Cisco Secure Firewall - Connection to File Sharing Domain Undefined SPL
Cisco Secure Firewall - File Download Over Uncommon Port Undefined SPL
Cisco Secure Firewall - High EVE Threat Confidence Undefined SPL
Cisco Secure Firewall - Malware File Downloaded Undefined SPL
Cisco Secure Firewall - Repeated Malware Downloads Undefined SPL

+ 32 more from splunk/security_content → showing the 10 highest-severity

Wazuh Core Ruleset

19 rules
Detection Severity Format
Executable file dropped in folder commonly used by malware Critical Wazuh XML
Executable file dropped in Users\Public folder by SSH enabled copy software Critical Wazuh XML
Suspicious executable file creation by rundll32 · win.eventdata.image = (?i)rundll32.exe, win.eventdata.targetFilename = \.(exe|com|dll|vbs|js|bat|cmd|pif|wsh|ps1|lnk|msi|vbe) Critical Wazuh XML
Suspicious file compression activity by powershell · win.eventdata.image = (?i)powershell.exe, win.eventdata.targetFilename = \.(7z|zip|rar) Critical Wazuh XML
Executable file created by mshta · win.eventdata.image = (?i)mshta\.exe, win.eventdata.targetFilename = (?i)\.(exe|com|dll|vbs|js|bat|cmd|pif|wsh|ps1|lnk|msi|vbe) High Wazuh XML
Executable file dropped in Users\Public folder High Wazuh XML
launched with commands to create a binary file · win.eventdata.originalFileName = (?i)certutil\.exe, win.eventdata.commandLine = (?i)\-urlcache.+\.(dll|exe) High Wazuh XML
launched with commands to create a binary file · win.eventdata.originalFileName = (?i)(curl|wget)\.exe, win.eventdata.commandLine = (?i)\-(o|out|outfile).+\.(dll|exe) High Wazuh XML
Security group with inbound rules allowing "Unknown cidrIp" on port "Unknown port" detected. High Wazuh XML
created a new scripting file under Windows Temp or User data folder · win.eventdata.image = (?i)\\((c|w)script|powershell)\.exe Medium Wazuh XML

+ 9 more from Wazuh Core Ruleset → showing the 10 highest-severity

socfortress/Wazuh-Rules

16 rules · 13 families
Detection Severity Format
Powershell script: Download method detected High Wazuh XML
Powershell script: Invoke-WebRequest detected High Wazuh XML
Powershell script: iwr alias detected High Wazuh XML
Powershell script: Net.WebClient object creation detected High Wazuh XML
Sysmon - Event 1: Process creation · Ingress Tool Transfer (T1105) 2 variants High Wazuh XML
Suspicious network tool execution detected - Possible Ingress Tool Transfer (T1105) Medium Wazuh XML
operation. · office_365.Operation = FileDownloaded Low Wazuh XML
Sysmon - Event 12: RegistryEvent (Object create and delete) by · Ingress Tool Transfer (T1105) Low Wazuh XML
Sysmon - Event 13: RegistryEvent (Value Set) by · Ingress Tool Transfer (T1105) Low Wazuh XML
Sysmon - Event 14: RegistryEvent (Key and Value Rename) by · Ingress Tool Transfer (T1105) Low Wazuh XML

+ 6 more from socfortress/Wazuh-Rules → showing the 10 highest-severity

chronicle/detection-rules

8 rules
Detection Severity Format
file_download_using_notepad_plus_plus_gup_utility High YARA-L
file_download_via_windows_defender_mpcmdrun_exe High YARA-L
finger_exe_execution High YARA-L
printbrm_zip_creation_or_extraction High YARA-L
pua_nimgrab_execution High YARA-L
suspicious_certreq_command_to_download High YARA-L
suspicious_curl_exe_download High YARA-L
suspicious_invoke_webrequest_execution High YARA-L

chainguard-dev/osquery-defense-kit

4 rules
Detection Severity Format
Suspicious parenting of fetch tools (event-based) Undefined osquery SQL
Suspicious parenting of fetch tools (state-based) Undefined osquery SQL
Suspicious URL requests by built-in fetching tools (event-based) Undefined osquery SQL
Suspicious URL requests by built-in fetching tools (state-based) Undefined osquery SQL

Azure/Azure-Sentinel

2 rules
Detection Severity Format
BadUSB LOLBIN execution via certutil (HID injection via Run dialog) Undefined KQL
Certutil (LOLBins and LOLScripts, Normalized Process Events) Undefined KQL

Bert-JanP/Hunting-Queries-Detection-Rules

2 rules
Detection Severity Format
Certutil Remote Download Undefined KQL
MITRE ATT&CK Mapping Undefined KQL

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.