T1105
Ingress Tool Transfer
ESXi · Linux · macOS · Network Devices · Windows2 pieces on this siteT1105 on attack.mitre.org
Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp. Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer).
Detect it
Hunts and rules you can run, each stating what it needs and what else it returns.
Sigma network pack: four rules for DNS, proxy and firewall logs
Long DNS labels, scripting-engine user agents at the proxy, executables fetched from a bare IP address, and SMB leaving the network. Written for the log sources most estates already collect and rarely alert on.
YARA triage samples: five heuristic rules for a web root, a script directory or a triage collection
Request-fed web shells in PHP and ASP.NET, PowerShell that decodes, executes and reaches the network in one file, ransom notes, and LSASS minidumps left on disk. Hunting rules that produce files to open, not verdicts.
how MITRE says to see it
Detect Ingress Tool Transfers via Behavioral Chain
- Unusual or uncommon processes initiate network connections to external destinations followed by file creation (tools downloaded).
- Shell-based tools (curl, wget, scp) initiate connections to external domains followed by creation of executable files on disk.
- Process execution of curl or wget followed by a network connection and a file created in temporary or user-specific directories.
- Command line interface or vCLI triggers remote transfer using wget or curl, writing files into datastore paths or local tmp directories.
what reduces it
- M1031 Network Intrusion Prevention. Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware or unusual data transfer over known protocols like FTP can be used to mitigate activity at the network level.
- M1037 Filter Network Traffic. Use network filtering to block outbound traffic from compromised systems to unapproved external destinations. Restricting access to known, trusted IP addresses and protocols can prevent attackers from downloading malicious tools or payloads onto compromised servers after gaining initial access.