Almost every intrusion has to bring something in, a second-stage payload, a tunnelling tool or a credential dumper, and that download is one of the few moments where the attacker must touch both the network and the disk. MITRE ATT&CK T1105 Ingress Tool Transfer covers transferring tools or files from an external system into a compromised environment, over the command and control channel or through other protocols. In ATT&CK v20 it sits in the Command and Control tactic (TA0011), applies to Windows, Linux, macOS, ESXi and network devices, and has more than 500 recorded software and group users (391 malware families, 90 groups and 20 tools), which makes it one of the most widely used techniques in the knowledge base. This guide explains how the technique works at the level of the ATT&CK description, where it shows up, and how to detect and constrain it with process, network and file telemetry and egress controls. It is for detection engineers, SOC analysts and network and endpoint owners, and contains no download procedures. For how loaders use these downloads in an infection chain, see the Malware Loaders and Droppers Guide.
Key takeaways
- Detect the chain, not the tool. ATT&CK's detection strategy DET0060 correlates an unusual process making an external connection with a file being written shortly after, which works whatever utility was used.
- Built-in utilities do most of the work. ATT&CK names certutil, PowerShell, curl, wget, scp and package managers, and the LOLBAS project lists 58 Windows binaries, scripts and libraries with a download capability.
- Egress control is the strongest prevention. Servers that cannot reach arbitrary internet destinations cannot pull tools, which is why ATT&CK's mitigations are M1037 Filter Network Traffic and M1031 Network Intrusion Prevention.
- Cloud sync and web services blur the boundary. ATT&CK notes adversaries can trigger sync clients such as OneDrive or Dropbox from a compromised cloud account, so file arrival may not look like a download at all.
- It precedes almost everything else. A reliable T1105 detection is an early warning for credential theft, lateral movement and ransomware staging.
How the attack works
ATT&CK describes T1105 as copying tools or files "from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols". Moving tools between hosts already inside the network is a separate technique, T1570 Lateral Tool Transfer. Defenders can group the transfer paths as follows:
| Path | Examples named by ATT&CK or LOLBAS | Where it becomes visible |
|---|---|---|
| Native Windows utilities | certutil, PowerShell web cmdlets and .NET web clients, BITS (bitsadmin), finger, copy from remote shares; LOLBAS lists others such as Desktopimgdownldr, Esentutl, Expand and MpCmdRun | Process creation with URL or UNC arguments, network connection from a process that rarely connects out, new file in a user-writable path |
| Native Unix and ESXi utilities | curl, wget, scp, sftp, tftp, rsync, finger; wget, curl and scp also exist on ESXi | auditd execve and connect, file writes to /tmp, /dev/shm or datastore paths, ESXi shell and hostd logs |
| Installers and package managers | yum, winget, msiexec with remote packages | Package manager runs outside change windows, packages from unapproved repositories |
| The C2 channel itself | Implants pulling modules over HTTPS, DNS or other C2 protocols | Proxy and DNS logs, beaconing patterns, files written by the implant process |
| Web services and sync | Cloud storage, code hosting, paste sites; sync clients triggered from a compromised cloud account | Downloads from sanctioned domains by unusual processes; sync client writing executables |
| User-assisted delivery | The search-ms protocol handler and remote file searches combined with phishing and T1204 User Execution | Explorer or the browser opening remote search results, followed by execution |
ATT&CK also notes that adversaries may verify a downloaded file's hash, for example with certutil -hashfile, which is itself a useful hunting signal on hosts where certutil is not used for administration.
Where it shows up
- Post-exploitation tooling: ATT&CK records Scattered Spider downloading the Teleport remote access tool to compromised VMware vCenter servers, and APT41 using certutil to download additional files. See the Scattered Spider Threat Actor Profile.
- Living off the land on domain controllers: CISA advisory AA24-038A describes Volt Typhoon downloading an outdated copy of
comsvcs.dllto a domain controller and placing it in a non-standard folder, then deploying renamed and UPX-packed FRP clients. See the Volt Typhoon Threat Actor Profile. - Loader chains: commodity loaders fetch the next stage from attacker or compromised infrastructure. See the Latrodectus and Bumblebee Loaders Guide.
- Script-based retrieval: ATT&CK records FIN7 using a PowerShell script to retrieve an additional payload, which overlaps with T1059 Command and Scripting Interpreter.
- Hypervisors and appliances: ESXi hosts and network devices with storage or automation hooks receive tools directly, where EDR is usually absent. See the ESXi Logs Detection Guide.
Impact
Ingress tool transfer is an enabler. Once tools arrive, an intruder can tunnel out (T1572), dump credentials, move laterally and deploy ransomware. The longer a download goes unnoticed, the more capability the adversary assembles inside your boundary. The direct impacts for defenders are lost dwell-time advantage, new persistent tooling to evict, and in regulated environments the need to prove which systems received attacker files.
Detection
DET0060 "Detect Ingress Tool Transfers via Behavioral Chain" defines one analytic per platform. Build each as a correlation, not a single-event match.
| Platform | ATT&CK analytic | Telemetry | What to look for |
|---|---|---|---|
| Windows | AN0165 | Sysmon 1 (process), 3 (network connection), 22 (DNS query), 11 (file create); Security 4688 with command line | Uncommon processes connecting to external destinations followed by file creation; URL or UNC arguments to certutil, bitsadmin, msiexec, PowerShell or other LOLBAS download binaries |
| Windows (file origin) | Supporting | Sysmon 15 FileCreateStreamHash, Sysmon 29 FileExecutableDetected | Executables written to disk, and Zone.Identifier streams showing an internet origin, in user-writable or non-standard paths |
| Linux | AN0166 | auditd SYSCALL connect, execve, write; iptables LOG | curl, wget or scp connecting to external domains then creating executable files, especially in /tmp or /dev/shm |
| macOS | AN0167 | Endpoint Security ES_EVENT_TYPE_NOTIFY_EXEC, unified log file writes and connections | curl or wget followed by a file in temporary or user-specific directories |
| ESXi | AN0168 | hostd command execution, vmkernel file writes | wget or curl writing into datastore paths or local tmp directories |
| Network devices | AN0169 | Flow records, device syslog | Anomalous inbound transfers or high-volume flows to devices with storage or automation hooks |
| Network edge | Supporting | Proxy, SWG, DNS and firewall logs | Servers fetching from the internet, newly registered or uncategorised domains, raw IP URLs, executable or archive downloads by non-browser user agents |
Tuning advice
- Baseline who downloads: software distribution agents, update services and developer tooling legitimately fetch files. Allowlist by signer, parent process and destination, not by command text alone.
- Weight by host role: a download on a domain controller, hypervisor or database server is far more suspicious than on a developer workstation.
- Join with what happens next: a downloaded file that executes, loads as a DLL or creates persistence within minutes is the high-confidence alert.
- Hunt the BITS and certutil caches: both leave artefacts on disk and in logs that survive after the file itself is deleted. See the Threat Hunting Guide.
For the Sysmon configuration needed to collect these events, see the Sysmon Guide.
Prevention and hardening
| Control | Setting or approach | Effect on T1105 |
|---|---|---|
| Deny-by-default egress for servers | Firewall policy that allows only named update and service destinations (NIST SP 800-53 SC-7(5)); force remaining traffic through an authenticated proxy | Removes the path for most server-side downloads |
| Secure web gateway and DNS filtering | Block newly registered, uncategorised and known-malicious domains; block executable and script downloads for non-browser user agents. See the Secure Web Gateway and Web Filtering Guide | Cuts commodity delivery and makes remaining downloads visible |
| TLS inspection where lawful | Inspect high-risk categories and file downloads. See the TLS Inspection Guide | Lets the gateway see file types and content |
| Application control | App Control for Business or AppLocker; Microsoft's recommended block rules (for example mshta.exe, wmic.exe, cscript.exe, wscript.exe) where not needed; deny execution from user-writable paths. See the Application Allowlisting Guide | A downloaded tool that cannot run has little value |
| Attack surface reduction rules | "Block JavaScript or VBScript from launching downloaded executable content" (d3e037e1-3eb8-44c8-a917-57927947596d); "Block executable files from running unless they meet a prevalence, age, or trusted list criterion" (01443614-cd74-433a-b99e-2ecdc07bfc25); "Block executable content from email client and webmail" (be9ba2d9-53ea-4cdc-84e5-9b1eeee46550) | Blocks common script-to-download-to-execute chains |
| Linux and ESXi hardening | Mount /tmp and /dev/shm noexec, use fapolicyd, disable the ESXi shell and SSH except during maintenance. See the VMware ESXi Hardening Guide | Downloaded binaries cannot execute from common staging paths |
| Package source control | Point package managers at an internal mirror or proxy; restrict winget sources. See the Private Package Repository and Proxy Guide | Stops package managers becoming a download channel |
| Network intrusion prevention | Signatures for known tool downloads and C2 retrieval patterns (ATT&CK M1031) | Catches known tooling in transit |
Rolling out egress and execution controls
- Inventory: list server roles and the internet destinations each genuinely needs, from proxy and firewall logs over 30 days.
- Audit: enable ASR rules and App Control policies in audit mode, and log (do not block) denied egress for two to four weeks.
- Pilot: enforce on a ring of low-risk servers and workstations, with an exception process and named owners.
- Enforce by tier: domain controllers, hypervisors and identity infrastructure first, then general servers, then workstations.
- Roll back safely: keep the previous firewall policy and App Control policy version ready to redeploy, and switch individual ASR rules back to audit rather than disabling all of them.
Where identity fits
Downloads by service accounts and machine identities are often the clearest signal: a SQL Server service account or a deployment pipeline identity fetching an executable from an unknown domain is rarely legitimate. Record which non-human identities may download, from where, and alert on anything outside that list. Pipeline and package manager credentials that can pull from external repositories deserve the same scrutiny. See the Service Account Security Guide.
Lessons from incidents
In the SolarWinds supply chain compromise, ATT&CK records that after the SUNBURST backdoor was in place, APT29 downloaded additional malware such as TEARDROP and Cobalt Strike to selected victims. The trusted, signed initial foothold meant the follow-on downloads were one of the earlier points where network and endpoint telemetry could have revealed hands-on activity. Server egress restrictions on management platforms and correlation of "trusted process connects out, then writes a new file" are the lessons that carry over.
Common failure patterns
- Servers with open internet egress: domain controllers and hypervisors that can browse anywhere make T1105 trivial.
- Signature-only detection on tool names: renamed copies of utilities defeat it. Pair with T1036 Masquerading detections that check original file names.
- Trusting sanctioned cloud domains completely: files from cloud storage or code hosting sites bypass reputation filters. See the Cloud Services Abuse for C2 Guide.
- No telemetry on hypervisors and appliances: the hosts with the least visibility receive the most damaging tools.
- Alerting on every download: unscoped rules drown analysts and are switched off; correlate with host role and follow-on execution.
Framework mapping
| Framework | Reference | Relevance |
|---|---|---|
| MITRE ATT&CK v20 | T1105 (TA0011); related T1570, T1102, T1204 | The technique and its neighbours |
| ATT&CK mitigations | M1037 Filter Network Traffic; M1031 Network Intrusion Prevention | Official mitigations |
| NIST SP 800-53 Rev. 5 | SC-7 and SC-7(5) Boundary Protection; SI-4(4) Inbound and Outbound Communications Traffic | Egress control and monitoring |
| NIST SP 800-53 Rev. 5 | CM-7(5) Authorized Software; SI-3 Malicious Code Protection | Execution control and malware scanning of arrivals |
| NIST CSF 2.0 | PR.PS-05; DE.CM-01; DE.CM-09 | Preventing unauthorised software; network and endpoint monitoring |
| MITRE Engage | Network Monitoring, Isolation, Network Manipulation | Engagement activities mapped to T1105 |
Practitioner checklist
- Collect process, network, DNS and file creation telemetry (Sysmon 1, 3, 11, 15, 22, 29 or EDR equivalents; auditd on Linux; ESXi logs).
- Build DET0060-style correlations per platform: unusual process, external connection, new file, then execution.
- Enforce deny-by-default egress for servers, starting with domain controllers, hypervisors and identity systems.
- Route remaining traffic through a proxy that blocks risky categories and executable downloads by non-browser agents.
- Deploy application control and the relevant ASR rules, audit first, with a documented rollback.
- Mount Linux staging paths
noexecand keep the ESXi shell disabled outside maintenance. - List which service accounts and pipelines may download, and alert on any others.
- Track mean time to detect a test download per host tier as a standing purple team metric.
Standards and references
- MITRE ATT&CK: Ingress Tool Transfer (T1105)
- MITRE ATT&CK: Lateral Tool Transfer (T1570)
- CISA: AA24-038A PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure
- Microsoft: Attack surface reduction rules reference
- Microsoft: Applications that can bypass App Control and how to block them
- Microsoft Sysinternals: Sysmon
- LOLBAS Project: Living Off The Land Binaries, Scripts and Libraries
- NIST: SP 800-53 Rev. 5 Security and Privacy Controls
Related NHI Mgmt Group resources: Malware Loaders and Droppers Guide · Living off the Land Guide · Secure Web Gateway and Web Filtering Guide · Sysmon Guide · T1218 System Binary Proxy Execution Defensive Guide