T1105 — Ingress Tool Transfer

Tactic: Command and Control · Platforms: ESXi, Linux, macOS, Network Devices, Windows

Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp. Once present,…

Sigma detection rules (5)

title: T1105 Ingress Tool Transfer
id: 8519fb29-9ff7-4910-abeb-4ac4088520d9
description: 'Detects command-line tool-transfer utilities (certutil urlcache/-decode, bitsadmin /transfer, PowerShell WebClient/Invoke-WebRequest, curl, wget) used to pull files from an external system into the compromised environment. (Data Component: Process Creation; baseline tier: windows-eventid.) Tune using: ParentProcessName, DestinationIPCategory, FilePathRegex.'
references:
  - https://attack.mitre.org/techniques/T1105
author: Shahrukh Khan
date: 2026-04-24
license: MIT
tags:
  - attack.command-and-control
  - attack.t1105

logsource:
  category: process_creation
  product: windows

detection:
  selection_certutil:
    Image|endswith: '\certutil.exe'
    CommandLine|contains:
      - 'urlcache'
      - '-decode'
      - '-decodehex'
  selection_bitsadmin:
    Image|endswith: '\bitsadmin.exe'
    CommandLine|contains: '/transfer'
  selection_iwr:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
    CommandLine|contains:
      - 'Invoke-WebRequest'
      - 'Net.WebClient'
      - 'DownloadFile'
      - 'DownloadString'
  selection_curlwget:
    Image|endswith:
      - '\curl.exe'
      - '\wget.exe'
  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: 1 of selection_* and not filter_system_account

falsepositives:
  - Legitimate admin/patch-management use of certutil, bitsadmin, or scripted downloads.
  - System and service accounts (SYSTEM, LOCAL SERVICE, NETWORK SERVICE) performing the same action are excluded via filter_system_account; tune further with process/path allowlists if noise remains.

level: medium

title: T1105 Ingress Tool Transfer
id: eddbe83a-a46e-469d-bff0-b85266151300
description: 'Detect Ingress Tool Transfers via Behavioral Chain: a curl/wget invocation with an explicit output flag (-o/-O/--output) that also creates a script/binary file, corrected to require both the download invocation and the file creation together (previously either alone would fire) and moved to the process_creation logsource since the primary signal is the EXECVE-typed download command. (Retargeted to the process_creation auditd telemetry that actually captures this techniques behavior; see logsource below.) Tune using: ToolName, DownloadExtension.'
references:
  - https://attack.mitre.org/techniques/T1105
author: Shahrukh Khan
date: 2026-05-17
license: MIT
tags:
  - attack.command-and-control
  - attack.t1105

logsource:
  category: process_creation
  product: linux

detection:
  selection_dl:
    type: EXECVE
    a0|endswith:
      - '/curl'
      - '/wget'
    a1|contains:
      - '-o'
      - '-O'
      - '--output'
  selection_create:
    type: PATH
    nametype: CREATE
    name|endswith:
      - '.sh'
      - '.elf'
      - '.bin'
      - '.py'

  condition: all of selection*

falsepositives:
  - Legitimate software installation and update scripts routinely download and write executable files via curl/wget; scope to unusual destination directories (/tmp, /dev/shm) and unsigned/unexpected file types.

level: high

title: T1105 Ingress Tool Transfer
id: d157327e-69d4-4acf-9e88-2a44203cea9b
description: 'Detect Ingress Tool Transfers via Behavioral Chain. (Retargeted to the file_event macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: DirectoryTargeted, ProcessPath.'
references:
  - https://attack.mitre.org/techniques/T1105
author: Shahrukh Khan
date: 2026-01-18
license: MIT
tags:
  - attack.command-and-control
  - attack.t1105

logsource:
  category: file_event
  product: macos

detection:
  selection:
    TargetFilename|contains:
      - '/tmp/'
      - '/private/tmp/'
    TargetFilename|endswith:
      - '.sh'
      - '.py'
      - '.command'
    Image|endswith:
      - '/curl'
      - '/osascript'

  condition: selection

falsepositives:
  - Developers downloading and staging scripts in temp directories for legitimate testing.

level: high

title: T1105 Ingress Tool Transfer
id: dda16fd9-f641-4ee8-be19-84893893ed51
description: 'Detect Ingress Tool Transfers via Behavioral Chain. (Data Component: Network Traffic Flow; baseline tier: fallback.) All three sub-selections (curl, wget, scp) now require an argument-level indicator of an actual remote transfer -- a URL/protocol scheme for curl and wget, or a remote host:path target for scp -- rather than a bare binary-name match. Tune using: PayloadVolumeThreshold, ProtocolUsed.'
references:
  - https://attack.mitre.org/techniques/T1105
author: Shahrukh Khan
date: 2026-02-08
license: MIT
tags:
  - attack.command-and-control
  - attack.t1105

logsource:
  category: process_creation
  product: linux
  service: auditd

detection:
  selection_curl:
    type: EXECVE
    a0|endswith: '/curl'
    a1|contains:
      - 'http://'
      - 'https://'
  selection_wget:
    type: EXECVE
    a0|endswith: '/wget'
  selection_wget_url:
    - a1|contains:
        - 'http://'
        - 'https://'
        - 'ftp://'
    - a2|contains:
        - 'http://'
        - 'https://'
        - 'ftp://'
    - a3|contains:
        - 'http://'
        - 'https://'
        - 'ftp://'
  selection_scp:
    type: EXECVE
    a0|endswith: '/scp'
  selection_scp_remote:
    - a1|re: '^[^:\\s]+:[^:\\s]'
    - a2|re: '^[^:\\s]+:[^:\\s]'

  condition: selection_curl or (selection_wget and selection_wget_url) or (selection_scp and selection_scp_remote)

falsepositives:
  - This rule was retargeted from file_event to process_creation because auditd captures the download command via EXECVE rather than the resulting file write; package managers, update scripts, and developers legitimately fetch remote files with curl, wget, or scp, so this will still fire on routine automation -- allowlist known CI/config-management hosts and paths as needed.

level: medium

title: T1105 Ingress Tool Transfer
id: 6384b518-70e8-42a5-9c3b-f2fb614a550b
description: 'Detect Ingress Tool Transfers via Behavioral Chain. (Retargeted to the process_creation ESXi telemetry that actually captures this techniques behavior; see logsource below.) Tune using: ToolName, DatastorePath.'
references:
  - https://attack.mitre.org/techniques/T1105
author: Shahrukh Khan
date: 2026-04-02
license: MIT
tags:
  - attack.command-and-control
  - attack.t1105

logsource:
  category: process_creation
  product: esxi
  service: shell

detection:
  selection_transfer:
    CommandLine|contains:
      - 'wget '
      - 'curl '
      - 'tftp '
      - 'scp '
  selection_dest:
    CommandLine|contains:
      - '/tmp/'
      - '/vmfs/volumes/'

  condition: selection_transfer and selection_dest

falsepositives:
  - Administrators intentionally staging patches, drivers, or diagnostic tools into a datastore path or /tmp during authorized maintenance.

level: high

Explore

• All Sigma rules for MITRE ATT&CK
• Sigma rule format guide
• Full T1105 intelligence — ATT&CK Intelligence View
• Official MITRE ATT&CK entry
• Built by Shahrukh Khan