Live Active security incident? Get immediate response
MITRE ATT&CK® Technique

T1105: Ingress Tool Transfer

Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp. Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer).

On Windows, adversaries may use various utilities to download tools, such as `copy`, `finger`, certutil, and PowerShell commands such as IEX(New-Object Net.WebClient).downloadString() and Invoke-WebRequest. On Linux and macOS systems, a variety of utilities also exist, such as `curl`, `scp`, `sftp`, `tftp`, `rsync`, `finger`, and `wget`.[1] A number of these tools, such as `wget`, `curl`, and `scp`, also exist on ESXi. After downloading a file, a threat actor may attempt to verify its integrity by checking its hash value (e.g., via `certutil -hashfile`).[2]

Adversaries may also abuse installers and package managers, such as `yum` or `winget`, to download tools to victim hosts. Adversaries have also abused file application features, such as the Windows `search-ms` protocol handler, to deliver malicious files to victims through remote file searches invoked by User Execution (typically after interacting with Phishing lures).[3]

Files can also be transferred using various Web Services as well as native or otherwise present tools on the victim system.[4] In some cases, adversaries may be able to leverage services that sync between a web-based and an on-premises client, such as Dropbox or OneDrive, to transfer files onto victim systems. For example, by compromising a cloud account and logging into the service's web portal, an adversary may be able to trigger an automatic syncing process that transfers the file onto the victim's machine.[5]

EnterpriseT1105TechniqueObject v2.6 Modified
Discuss defensive coverage Back to ATT&CK
Glexia's Take

Analyst context for executives and security teams

Analyst confidence High

Ingress Tool Transfer matters because it is often the point where an intrusion becomes operational: after access, the adversary brings in tools, scripts, malware, or supporting files needed to continue command-and-control activity. For leaders, the practical question is whether the organization can see and control unexpected file movement into Windows, Linux, macOS, ESXi, and network-device environments, including transfers over ordinary utilities, package managers, web services, and cloud-sync clients.

Executive priority

Prioritize this technique as a resilience and incident-response readiness issue. If attackers can freely pull tools into the environment, containment becomes harder and dwell time can increase. Executives should ask whether network boundaries, egress controls, endpoint logging, cloud-sync governance, and SOC playbooks can distinguish legitimate administration from suspicious tool staging. The broad campaign relationships in ATT&CK show this behavior appears across espionage, ransomware, supply-chain, critical infrastructure, and financially motivated contexts, but local risk depends on actual exposure, logging, and control coverage.

Technical view

T1105 is an enterprise command-and-control technique covering external-to-internal file transfer and, after entry, possible spread between victim devices via related lateral transfer behavior. Validate visibility across the listed platforms: Windows, Linux, macOS, ESXi, and network devices. Focus on suspicious use of built-in or commonly present utilities and services named by ATT&CK, including copy, finger, certutil, PowerShell download methods, curl, scp, sftp, tftp, rsync, wget, installers/package managers such as yum and winget, web services, and sync clients such as Dropbox or OneDrive. Because ATT&CK provides no official detection text for this object, use the related DET0060 strategy directionally: detect behavioral chains rather than single commands only.

Likely telemetry

  • Endpoint process creation and command-line telemetry for transfer utilities and package managers
  • PowerShell execution logs and script-block or command content where available
  • File creation, modification, and hash calculation events following network retrieval
  • Network connection, proxy, firewall, DNS, and TLS metadata for outbound and inbound file transfer activity
  • Cloud-sync and web-service audit logs, especially account access followed by local file synchronization

Detection direction

  • Validate behavioral-chain detection: network retrieval followed by new file creation, hash verification, execution, persistence, or lateral movement is higher value than alerting on curl or PowerShell alone.
  • Tune for administrative false positives by baselining approved software distribution, patching, package management, backup, and engineering workflows.
  • Review blind spots around ESXi hosts, network devices, unmanaged Linux/macOS systems, and cloud-sync clients, where endpoint coverage may be weaker.
  • Correlate suspicious downloads with command-and-control context, unusual destinations, rare user agents, unexpected protocols, or transfers from untrusted external systems.
  • Include cloud account activity in triage when sync services can cause files to appear on endpoints without a traditional endpoint-initiated download.

Mitigation priorities

  • Start with network boundary controls aligned to M1031: use intrusion detection/prevention signatures where appropriate to block known malicious or policy-violating transfer traffic.
  • Apply M1037-style traffic filtering: restrict ingress, egress, and lateral network traffic to approved protocols, destinations, and administrative paths.
  • Harden and monitor allowed administrative utilities rather than assuming they can be removed; many named tools are legitimate and cross-platform.
  • Govern cloud-sync and web-service usage with approved-service policies, account monitoring, and incident procedures for compromised accounts.
  • Ensure incident response playbooks preserve command lines, downloaded files, hashes, network metadata, and cloud-sync evidence before containment actions remove context.
Analyst notes and limits

The ATT&CK object is broad and platform-spanning, so value comes from local scoping: which transfer tools are normal, which systems lack endpoint logging, and which cloud-sync paths can introduce files automatically. The relationship to DET0060 supports a behavioral-chain approach; the relationships to M1031 and M1037 support network prevention and filtering as control priorities. Numerous ATT&CK campaign relationships indicate the technique is common across different intrusion types, but they do not by themselves prove current activity in any specific environment.

Official ATT&CK detection guidance for this object is not provided. The supplied data does not include specific indicators, detection logic, prevalence, or guaranteed control effectiveness. Any assessment of exposure or coverage requires local telemetry, asset inventory, approved administration patterns, and cloud-service configuration evidence.

Official MITRE ATT&CK definition

Ingress Tool Transfer

Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp. Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer).

On Windows, adversaries may use various utilities to download tools, such as `copy`, `finger`, certutil, and PowerShell commands such as IEX(New-Object Net.WebClient).downloadString() and Invoke-WebRequest. On Linux and macOS systems, a variety of utilities also exist, such as `curl`, `scp`, `sftp`, `tftp`, `rsync`, `finger`, and `wget`.[1] A number of these tools, such as `wget`, `curl`, and `scp`, also exist on ESXi. After downloading a file, a threat actor may attempt to verify its integrity by checking its hash value (e.g., via `certutil -hashfile`).[2]

Adversaries may also abuse installers and package managers, such as `yum` or `winget`, to download tools to victim hosts. Adversaries have also abused file application features, such as the Windows `search-ms` protocol handler, to deliver malicious files to victims through remote file searches invoked by User Execution (typically after interacting with Phishing lures).[3]

Files can also be transferred using various Web Services as well as native or otherwise present tools on the victim system.[4] In some cases, adversaries may be able to leverage services that sync between a web-based and an on-premises client, such as Dropbox or OneDrive, to transfer files onto victim systems. For example, by compromising a cloud account and logging into the service's web portal, an adversary may be able to trigger an automatic syncing process that transfers the file onto the victim's machine.[5]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

Associated objects

Groups, software, and campaigns

Group Enterprise

G0117: Fox Kitten

Fox Kitten is threat actor with a suspected nexus to the Iranian government that has been active since at least 2017 against entities in the Middle East, North Africa, Europe, Australia, and North America. Fox Kitten has targeted multiple industrial verticals including oil and gas, technology, government, defense, healthcare, manufacturing, and engineering.[1][2][3][4]

Group Enterprise

G1002: BITTER

BITTER is a suspected South Asian cyber espionage threat group that has been active since at least 2013. BITTER has targeted government, energy, and engineering organizations in Pakistan, China, Bangladesh, and Saudi Arabia.[1][2]

Group Enterprise

G0125: HAFNIUM

HAFNIUM is a likely state-sponsored cyber espionage group operating out of China that has been active since at least January 2021. HAFNIUM primarily targets entities in the US across a number of industry sectors, including infectious disease researchers, law firms, higher education institutions, defense contractors, policy think tanks, and NGOs. HAFNIUM has targeted remote management tools and cloud software for intial access and has demonstrated an ability to quickly operationalize exploits for identified vulnerabilities in edge devices.[1][2][3]

Group Enterprise

G0080: Cobalt Group

Cobalt Group is a financially motivated threat group that has primarily targeted financial institutions since at least 2016. The group has conducted intrusions to steal money via targeting ATM systems, card processing, payment systems and SWIFT systems. Cobalt Group has mainly targeted banks in Eastern Europe, Central Asia, and Southeast Asia. One of the alleged leaders was arrested in Spain in early 2018, but the group still appears to be active. The group has been known to target organizations in order to use their access to then compromise additional victims.[1][2][3][4][5][6][7] Reporting indicates there may be links between Cobalt Group and both the malware Carbanak and the group Carbanak.[8]

Group Enterprise

G1021: Cinnamon Tempest

Cinnamon Tempest is a China-based threat group that has been active since at least 2021 deploying multiple strains of ransomware based on the leaked Babuk source code. Cinnamon Tempest does not operate their ransomware on an affiliate model or purchase access but appears to act independently in all stages of the attack lifecycle. Based on victimology, the short lifespan of each ransomware variant, and use of malware attributed to government-sponsored threat groups, Cinnamon Tempest may be motivated by intellectual property theft or cyberespionage rather than financial gain.[1][2][3][4]

Group Enterprise

G1043: BlackByte

BlackByte is a ransomware threat actor operating since at least 2021. BlackByte is associated with several versions of ransomware also labeled BlackByte Ransomware. BlackByte ransomware operations initially used a common encryption key allowing for the development of a universal decryptor, but subsequent versions such as BlackByte 2.0 Ransomware use more robust encryption mechanisms. BlackByte is notable for operations targeting critical infrastructure entities among other targets across North America.[1][2][3][4][5]

Group Enterprise

G1015: Scattered Spider

Scattered Spider is a native English-speaking cybercriminal group active since at least 2022. [1] [2] The group initially targeted customer relationship management (CRM) providers, business process outsourcing (BPO) firms, and telecommunications and technology companies before expanding in 2023 to gaming, hospitality, retail, managed service provider (MSP), manufacturing, and financial sectors. [2] Scattered Spider relies heavily on social engineering, including impersonating IT and help-desk staff, to gain initial access, bypass multi-factor authentication (MFA), and compromise enterprise networks. The group has adapted its tooling to evade endpoint detection and response (EDR) defenses and used ransomware for financial gain. [3] [4] [5] Scattered Spider had expanded into hybrid cloud and identity environments, using help-desk impersonation and MFA bypass to obtain administrator access in Okta, AWS, and Office 365. [6]

Group Enterprise

G0032: Lazarus Group

Lazarus Group is a North Korean state-sponsored cyber threat group attributed to the Reconnaissance General Bureau (RGB). [1] [2] Lazarus Group has been active since at least 2009 and is reportedly responsible for the November 2014 destructive wiper attack on Sony Pictures Entertainment, identified by Novetta as part of Operation Blockbuster. Malware used by Lazarus Group correlates to other reported campaigns, including Operation Flame, Operation 1Mission, Operation Troy, DarkSeoul, and Ten Days of Rain.[3]

North Korea’s cyber operations have shown a consistent pattern of adaptation, forming and reorganizing units as national priorities shift. These units frequently share personnel, infrastructure, malware, and tradecraft, making it difficult to attribute specific operations with high confidence. Public reporting often uses “Lazarus Group” as an umbrella term for multiple North Korean cyber operators conducting espionage, destructive attacks, and financially motivated campaigns.[4][5][6]

Group Enterprise

G0068: PLATINUM

PLATINUM is an activity group that has targeted victims since at least 2009. The group has focused on targets associated with governments and related organizations in South and Southeast Asia. [1]

Group Enterprise

G0004: Ke3chang

Ke3chang is a threat group attributed to actors operating out of China. Ke3chang has targeted oil, government, diplomatic, military, and NGOs in Central and South America, the Caribbean, Europe, and North America since at least 2010.[1][2][3][4]

Group Enterprise

G0107: Whitefly

Whitefly is a cyber espionage group that has been operating since at least 2017. The group has targeted organizations based mostly in Singapore across a wide variety of sectors, and is primarily interested in stealing large amounts of sensitive information. The group has been linked to an attack against Singapore’s largest public health organization, SingHealth.[1]

Malware Enterprise

S0444: ShimRat

ShimRat has been used by the suspected China-based adversary Mofang in campaigns targeting multiple countries and sectors including government, military, critical infrastructure, automobile, and weapons development. The name "ShimRat" comes from the malware's extensive use of Windows Application Shimming to maintain persistence. [1]

Windows
Malware Enterprise

S1228: PUBLOAD

PUBLOAD is a stager malware that has been observed installing itself in existing directories such as `C:\Users\Public` or creating new directories to stage the malware and its components.[1] PUBLOAD malware collects details of the victim host, establishes persistence, encrypts victim details using RC4 and communicates victim details back to C2. PUBLOAD malware has previously been leveraged by China-affiliated actors identified as Mustang Panda. PUBLOAD is also known as “NoFive” and some public reporting identifies the loader component as CLAIMLOADER.[2]

Windows
Malware Enterprise

S0284: More_eggs

More_eggs is a JScript backdoor used by Cobalt Group and FIN6. Its name was given based on the variable "More_eggs" being present in its code. There are at least two different versions of the backdoor being used, version 2.0 and version 4.4. [1][2]

Windows
Campaign Enterprise

C0004: CostaRicto

CostaRicto was a suspected hacker-for-hire cyber espionage campaign that targeted multiple industries worldwide, with a large number being financial institutions. CostaRicto actors targeted organizations in Europe, the Americas, Asia, Australia, and Africa, with a large concentration in South Asia (especially India, Bangladesh, and Singapore), using custom malware, open source tools, and a complex network of proxies and SSH tunnels.[1]

Relationship explorer

All related ATT&CK context

uses · Group G0117: Fox Kitten Enterprise uses · Malware S0396: EvilBunny Enterprise uses · Malware S0664: Pandora Enterprise uses · Malware S0444: ShimRat Enterprise uses · Malware S1228: PUBLOAD Enterprise uses · Malware S1118: BUSHWALK Enterprise uses · Malware S1066: DarkTortilla Enterprise uses · Malware S0627: SodaMaster Enterprise uses · Group G1002: BITTER Enterprise uses · Malware S1019: Shark Enterprise uses · Malware S0284: More_eggs Enterprise uses · Malware S0185: SEASHARPEE Enterprise uses · Malware S0515: WellMail Enterprise uses · Group G0125: HAFNIUM Enterprise uses · Group G0080: Cobalt Group Enterprise uses · Malware S0255: DDKONG Enterprise uses · Malware S1048: macOS.OSAMiner Enterprise uses · Malware S0516: SoreFang Enterprise uses · Malware S1074: ANDROMEDA Enterprise uses · Malware S1013: ZxxZ Enterprise uses · Group G1021: Cinnamon Tempest Enterprise uses · Malware S0386: Ursnif Enterprise uses · Malware S1189: Neo-reGeorg Enterprise uses · Malware S0070: HTTPBrowser Enterprise
Mitigations

Mitigation direction

Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .

ATT&CK release
19.1
Object version
2.6
Created
Modified
Raw hash
1bb57885659a31fa...
Imported snapshots across ATT&CK releases (1)
Release Bundle imported Object version Modified Status Raw hash
19.1 2.6 Current bundle 1bb57885659a…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSON Open MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    t1105_lolbas

    LOLBAS. (n.d.). LOLBAS Mapped to T1105. Retrieved March 11, 2022.

    Open source URL
  2. [2]
    Google Cloud Threat Intelligence COSCMICENERGY 2023

    COSMICENERGY: New OT Malware Possibly Related To Russian Emergency Response Exercises. (2023, May 25). Ken Proska, Daniel Kapellmann Zafra, Keith Lunden, Corey Hildebrandt, Rushikesh Nandedkar, Nathan Brubaker. Retrieved March 18, 2025.

    Open source URL
  3. [3]
    T1105: Trellix_search-ms

    Mathanraj Thangaraju, Sijo Jacob. (2023, July 26). Beyond File Search: A Novel Method for Exploiting the "search-ms" URI Protocol Handler. Retrieved March 15, 2024.

    Open source URL
  4. [4]
    PTSecurity Cobalt Dec 2016

    Positive Technologies. (2016, December 16). Cobalt Snatch. Retrieved October 9, 2018.

    Open source URL
  5. [5]
    Dropbox Malware Sync

    David Talbot. (2013, August 21). Dropbox and Similar Services Can Sync Malware. Retrieved May 31, 2023.

    Open source URL
  6. [6]
    University of Birmingham C2

    Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.

    Open source URL
  7. [7]
    mitre-attack T1105
    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK site Official STIX data repository MITRE ATT&CK terms of use