Description
Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp. Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer).
On Windows, adversaries may use various utilities to download tools, such as copy, finger, certutil, and PowerShell commands such as IEX(New-Object Net.WebClient).downloadString() and Invoke-WebRequest. On Linux and macOS systems, a variety of utilities also exist, such as curl, scp, sftp, tftp, rsync, finger, and wget.(Citation: t1105_lolbas) A number of these tools, such as wget, curl, and scp, also exist on ESXi. After downloading a file, a threat actor may attempt to verify its integrity by checking its hash value (e.g., via certutil -hashfile).(Citation: Google Cloud Threat Intelligence COSCMICENERGY 2023)
Adversaries may also abuse installers and package managers, such as yum or winget, to download tools to victim hosts. Adversaries have also abused file application features, such as the Windows search-ms protocol handler, to deliver malicious files to victims through remote file searches invoked by User Execution (typically after interacting with Phishing lures).(Citation: T1105: Trellix_search-ms)
Files can also be transferred using various Web Services as well as native or otherwise present tools on the victim system.(Citation: PTSecurity Cobalt Dec 2016) In some cases, adversaries may be able to leverage services that sync between a web-based and an on-premises client, such as Dropbox or OneDrive, to transfer files onto victim systems. For example, by compromising a cloud account and logging into the service's web portal, an adversary may be able to trigger an automatic syncing process that transfers the file onto the victim's machine.(Citation: Dropbox Malware Sync)
Platforms
Mitigations (2)
Network Intrusion PreventionM1031
Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware or unusual data transfer over known protocols like FTP can be used to mitigate activity at the network level. Signatures are often for unique indicators within protocols and may be based on the specific obfuscation technique used by a particular adversary or tool, and w
Filter Network TrafficM1037
Use network filtering to block outbound traffic from compromised systems to unapproved external destinations. Restricting access to known, trusted IP addresses and protocols can prevent attackers from downloading malicious tools or payloads onto compromised servers after gaining initial access.
Threat Groups (88)
| ID | Group | Context |
|---|---|---|
| G0082 | APT38 | [APT38](https://attack.mitre.org/groups/G0082) used a backdoor, NESTEGG, that has the capability to download and upload files to and from a victim’s m... |
| G0119 | Indrik Spider | [Indrik Spider](https://attack.mitre.org/groups/G0119) has downloaded additional scripts, malware, and tools onto a compromised host.(Citation: Crowds... |
| G1043 | BlackByte | [BlackByte](https://attack.mitre.org/groups/G1043) has transferred tools such as [Cobalt Strike](https://attack.mitre.org/software/S0154) to victim en... |
| G0066 | Elderwood | The Ritsol backdoor trojan used by [Elderwood](https://attack.mitre.org/groups/G0066) can download files onto a compromised host from a remote locatio... |
| G1008 | SideCopy | [SideCopy](https://attack.mitre.org/groups/G1008) has delivered trojanized executables via spearphishing emails that contacts actor-controlled servers... |
| G0093 | GALLIUM | [GALLIUM](https://attack.mitre.org/groups/G0093) dropped additional tools to victims during their operation, including portqry.exe, a renamed cmd.exe ... |
| G0022 | APT3 | [APT3](https://attack.mitre.org/groups/G0022) has a tool that can copy files to remote machines.(Citation: FireEye Clandestine Fox) |
| G1020 | Mustard Tempest | [Mustard Tempest](https://attack.mitre.org/groups/G1020) has deployed secondary payloads and third stage implants to compromised hosts.(Citation: Micr... |
| G0094 | Kimsuky | [Kimsuky](https://attack.mitre.org/groups/G0094) has downloaded additional scripts, tools, and malware onto victim systems.(Citation: Talos Kimsuky No... |
| G1017 | Volt Typhoon | [Volt Typhoon](https://attack.mitre.org/groups/G1017) has downloaded an outdated version of comsvcs.dll to a compromised domain controller in a non-s... |
| G0040 | Patchwork | [Patchwork](https://attack.mitre.org/groups/G0040) payloads download additional files from the C2 server.(Citation: Securelist Dropping Elephant)(Cita... |
| G0096 | APT41 | [APT41](https://attack.mitre.org/groups/G0096) used [certutil](https://attack.mitre.org/software/S0160) to download additional files.(Citation: FireEy... |
| G0035 | Dragonfly | [Dragonfly](https://attack.mitre.org/groups/G0035) has copied and installed tools for operations once in the victim environment.(Citation: US-CERT TA1... |
| G0120 | Evilnum | [Evilnum](https://attack.mitre.org/groups/G0120) can deploy additional components or tools as needed.(Citation: ESET EvilNum July 2020) |
| G0078 | Gorgon Group | [Gorgon Group](https://attack.mitre.org/groups/G0078) malware can download additional files from C2 servers.(Citation: Unit 42 Gorgon Group Aug 2018) |
| G0045 | menuPass | [menuPass](https://attack.mitre.org/groups/G0045) has installed updates and new malware on victims.(Citation: PWC Cloud Hopper April 2017)(Citation: D... |
| G0050 | APT32 | [APT32](https://attack.mitre.org/groups/G0050) has added JavaScript to victim websites to download additional frameworks that profile and compromise w... |
| G0125 | HAFNIUM | [HAFNIUM](https://attack.mitre.org/groups/G0125) has downloaded malware and tools--including Nishang and PowerCat--onto a compromised host.(Citation: ... |
| G0069 | MuddyWater | [MuddyWater](https://attack.mitre.org/groups/G0069) has used malware that can upload additional files to the victim’s machine.(Citation: Securelist Mu... |
| G0047 | Gamaredon Group | [Gamaredon Group](https://attack.mitre.org/groups/G0047) has downloaded additional malware and tools onto a compromised host.(Citation: Palo Alto Gama... |
Associated Software (403)
| ID | Name | Type | Context |
|---|---|---|---|
| S0266 | TrickBot | Malware | [TrickBot](https://attack.mitre.org/software/S0266) downloads several additional files and saves them to the victim's machine.(Citation: Trend Micro T... |
| S0139 | PowerDuke | Malware | [PowerDuke](https://attack.mitre.org/software/S0139) has a command to download a file.(Citation: Volexity PowerDuke November 2016) |
| S0520 | BLINDINGCAN | Malware | [BLINDINGCAN](https://attack.mitre.org/software/S0520) has downloaded files to a victim machine.(Citation: US-CERT BLINDINGCAN Aug 2020) |
| S0206 | Wiarp | Malware | [Wiarp](https://attack.mitre.org/software/S0206) creates a backdoor through which remote attackers can download files.(Citation: Symantec Wiarp May 20... |
| S0662 | RCSession | Malware | [RCSession](https://attack.mitre.org/software/S0662) has the ability to drop additional files to an infected machine.(Citation: Profero APT27 December... |
| S0686 | QuietSieve | Malware | [QuietSieve](https://attack.mitre.org/software/S0686) can download and execute payloads on a target host.(Citation: Microsoft Actinium February 2022) |
| S1039 | Bumblebee | Malware | [Bumblebee](https://attack.mitre.org/software/S1039) can download and execute additional payloads including through the use of a `Dex` command.(Citati... |
| S9015 | BRICKSTORM | Malware | [BRICKSTORM](https://attack.mitre.org/software/S9015) has the ability to download files from the Adversaries C2 server to the compromised system.(Cita... |
| S1025 | Amadey | Malware | [Amadey](https://attack.mitre.org/software/S1025) can download and execute files to further infect a host machine with additional malware.(Citation: B... |
| S1192 | NICECURL | Malware | [NICECURL](https://attack.mitre.org/software/S1192) has the ability to download additional content onto an infected machine, e.g. by using `curl`.(Cit... |
| S0229 | Orz | Malware | [Orz](https://attack.mitre.org/software/S0229) can download files onto the victim.(Citation: Proofpoint Leviathan Oct 2017) |
| S0353 | NOKKI | Malware | [NOKKI](https://attack.mitre.org/software/S0353) has downloaded a remote module for execution.(Citation: Unit 42 NOKKI Sept 2018) |
| S0093 | Backdoor.Oldrea | Malware | [Backdoor.Oldrea](https://attack.mitre.org/software/S0093) can download additional modules from C2.(Citation: Gigamon Berserk Bear October 2021) |
| S0213 | DOGCALL | Malware | [DOGCALL](https://attack.mitre.org/software/S0213) can download and execute additional payloads.(Citation: Unit 42 Nokki Oct 2018) |
| S0134 | Downdelph | Malware | After downloading its main config file, [Downdelph](https://attack.mitre.org/software/S0134) downloads multiple payloads from C2 servers.(Citation: ES... |
| S0185 | SEASHARPEE | Malware | [SEASHARPEE](https://attack.mitre.org/software/S0185) can download remote files onto victims.(Citation: FireEye APT34 Webinar Dec 2017) |
| S0184 | POWRUNER | Malware | [POWRUNER](https://attack.mitre.org/software/S0184) can download or upload files from its C2 server.(Citation: FireEye APT34 Dec 2017) |
| S0164 | TDTESS | Malware | [TDTESS](https://attack.mitre.org/software/S0164) has a command to download and execute an additional file.(Citation: ClearSky Wilted Tulip July 2017) |
| S0546 | SharpStage | Malware | [SharpStage](https://attack.mitre.org/software/S0546) has the ability to download and execute additional payloads via a DropBox API.(Citation: Cyberea... |
| S1085 | Sardonic | Malware | [Sardonic](https://attack.mitre.org/software/S1085) has the ability to upload additional malicious files to a compromised machine.(Citation: Bitdefend... |
References
- Mathanraj Thangaraju, Sijo Jacob. (2023, July 26). Beyond File Search: A Novel Method for Exploiting the "search-ms" URI Protocol Handler. Retrieved March 15, 2024.
- COSMICENERGY: New OT Malware Possibly Related To Russian Emergency Response Exercises. (2023, May 25). Ken Proska, Daniel Kapellmann Zafra, Keith Lunden, Corey Hildebrandt, Rushikesh Nandedkar, Nathan Brubaker. Retrieved March 18, 2025.
- David Talbot. (2013, August 21). Dropbox and Similar Services Can Sync Malware. Retrieved May 31, 2023.
- Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.
- LOLBAS. (n.d.). LOLBAS Mapped to T1105. Retrieved March 11, 2022.
- Positive Technologies. (2016, December 16). Cobalt Snatch. Retrieved October 9, 2018.
Frequently Asked Questions
What is T1105 (Ingress Tool Transfer)?
T1105 is a MITRE ATT&CK technique named 'Ingress Tool Transfer'. It belongs to the Command and Control tactic(s). Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network th...
How can T1105 be detected?
Detection of T1105 (Ingress Tool Transfer) typically involves monitoring system logs, network traffic, and endpoint telemetry. Use SIEM rules, EDR solutions, and behavioral analytics to identify suspicious activity associated with this technique.
What mitigations exist for T1105?
There are 2 documented mitigations for T1105. Key mitigations include: Network Intrusion Prevention, Filter Network Traffic.
Which threat groups use T1105?
Known threat groups using T1105 include: APT38, Indrik Spider, BlackByte, Elderwood, SideCopy, GALLIUM, APT3, Mustard Tempest.