T1105: Ingress Tool Transfer
Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp. Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer).
On Windows, adversaries may use various utilities to download tools, such as `copy`, `finger`, certutil, and PowerShell commands such as IEX(New-Object Net.WebClient).downloadString() and Invoke-WebRequest. On Linux and macOS systems, a variety of utilities also exist, such as `curl`, `scp`, `sftp`, `tftp`, `rsync`, `finger`, and `wget`.Citationt1105_lolbas A number of these tools, such as `wget`, `curl`, and `scp`, also exist on ESXi. After downloading a file, a threat actor may attempt to verify its integrity by checking its hash value (e.g., via `certutil -hashfile`).CitationGoogle Cloud Threat Intelligence COSCMICENERGY 2023
Adversaries may also abuse installers and package managers, such as `yum` or `winget`, to download tools to victim hosts. Adversaries have also abused file application features, such as the Windows `search-ms` protocol handler, to deliver malicious files to victims through remote file searches invoked by User Execution (typically after interacting with Phishing lures).CitationT1105: Trellix_search-ms
Files can also be transferred using various Web Services as well as native or otherwise present tools on the victim system.CitationPTSecurity Cobalt Dec 2016 In some cases, adversaries may be able to leverage services that sync between a web-based and an on-premises client, such as Dropbox or OneDrive, to transfer files onto victim systems. For example, by compromising a cloud account and logging into the service's web portal, an adversary may be able to trigger an automatic syncing process that transfers the file onto the victim's machine.CitationDropbox Malware Sync
Security context for executives and security teams
Ingress Tool Transfer matters because it is often the point where an intrusion becomes operational: after access, the adversary brings in tools, scripts, malware, or supporting files needed to continue command-and-control activity. For leaders, the practical question is whether the organization can see and control unexpected file movement into Windows, Linux, macOS, ESXi, and network-device environments, including transfers over ordinary utilities, package managers, web services, and cloud-sync clients.
Executive priority
Prioritize this technique as a resilience and incident-response readiness issue. If attackers can freely pull tools into the environment, containment becomes harder and dwell time can increase. Executives should ask whether network boundaries, egress controls, endpoint logging, cloud-sync governance, and SOC playbooks can distinguish legitimate administration from suspicious tool staging. The broad campaign relationships in ATT&CK show this behavior appears across espionage, ransomware, supply-chain, critical infrastructure, and financially motivated contexts, but local risk depends on actual exposure, logging, and control coverage.
Technical view
T1105 is an enterprise command-and-control technique covering external-to-internal file transfer and, after entry, possible spread between victim devices via related lateral transfer behavior. Validate visibility across the listed platforms: Windows, Linux, macOS, ESXi, and network devices. Focus on suspicious use of built-in or commonly present utilities and services named by ATT&CK, including copy, finger, certutil, PowerShell download methods, curl, scp, sftp, tftp, rsync, wget, installers/package managers such as yum and winget, web services, and sync clients such as Dropbox or OneDrive. Because ATT&CK provides no official detection text for this object, use the related DET0060 strategy directionally: detect behavioral chains rather than single commands only.
Likely telemetry
- Endpoint process creation and command-line telemetry for transfer utilities and package managers
- PowerShell execution logs and script-block or command content where available
- File creation, modification, and hash calculation events following network retrieval
- Network connection, proxy, firewall, DNS, and TLS metadata for outbound and inbound file transfer activity
- Cloud-sync and web-service audit logs, especially account access followed by local file synchronization
Detection direction
- Validate behavioral-chain detection: network retrieval followed by new file creation, hash verification, execution, persistence, or lateral movement is higher value than alerting on curl or PowerShell alone.
- Tune for administrative false positives by baselining approved software distribution, patching, package management, backup, and engineering workflows.
- Review blind spots around ESXi hosts, network devices, unmanaged Linux/macOS systems, and cloud-sync clients, where endpoint coverage may be weaker.
- Correlate suspicious downloads with command-and-control context, unusual destinations, rare user agents, unexpected protocols, or transfers from untrusted external systems.
- Include cloud account activity in triage when sync services can cause files to appear on endpoints without a traditional endpoint-initiated download.
Mitigation priorities
- Start with network boundary controls aligned to M1031: use intrusion detection/prevention signatures where appropriate to block known malicious or policy-violating transfer traffic.
- Apply M1037-style traffic filtering: restrict ingress, egress, and lateral network traffic to approved protocols, destinations, and administrative paths.
- Harden and monitor allowed administrative utilities rather than assuming they can be removed; many named tools are legitimate and cross-platform.
- Govern cloud-sync and web-service usage with approved-service policies, account monitoring, and incident procedures for compromised accounts.
- Ensure incident response playbooks preserve command lines, downloaded files, hashes, network metadata, and cloud-sync evidence before containment actions remove context.
Additional notes and limits
The ATT&CK object is broad and platform-spanning, so value comes from local scoping: which transfer tools are normal, which systems lack endpoint logging, and which cloud-sync paths can introduce files automatically. The relationship to DET0060 supports a behavioral-chain approach; the relationships to M1031 and M1037 support network prevention and filtering as control priorities. Numerous ATT&CK campaign relationships indicate the technique is common across different intrusion types, but they do not by themselves prove current activity in any specific environment.
Official ATT&CK detection guidance for this object is not provided. The supplied data does not include specific indicators, detection logic, prevalence, or guaranteed control effectiveness. Any assessment of exposure or coverage requires local telemetry, asset inventory, approved administration patterns, and cloud-service configuration evidence.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Ingress Tool Transfer
Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp. Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer).
On Windows, adversaries may use various utilities to download tools, such as `copy`, `finger`, certutil, and PowerShell commands such as IEX(New-Object Net.WebClient).downloadString() and Invoke-WebRequest. On Linux and macOS systems, a variety of utilities also exist, such as `curl`, `scp`, `sftp`, `tftp`, `rsync`, `finger`, and `wget`.Citationt1105_lolbas A number of these tools, such as `wget`, `curl`, and `scp`, also exist on ESXi. After downloading a file, a threat actor may attempt to verify its integrity by checking its hash value (e.g., via `certutil -hashfile`).CitationGoogle Cloud Threat Intelligence COSCMICENERGY 2023
Adversaries may also abuse installers and package managers, such as `yum` or `winget`, to download tools to victim hosts. Adversaries have also abused file application features, such as the Windows `search-ms` protocol handler, to deliver malicious files to victims through remote file searches invoked by User Execution (typically after interacting with Phishing lures).CitationT1105: Trellix_search-ms
Files can also be transferred using various Web Services as well as native or otherwise present tools on the victim system.CitationPTSecurity Cobalt Dec 2016 In some cases, adversaries may be able to leverage services that sync between a web-based and an on-premises client, such as Dropbox or OneDrive, to transfer files onto victim systems. For example, by compromising a cloud account and logging into the service's web portal, an adversary may be able to trigger an automatic syncing process that transfers the file onto the victim's machine.CitationDropbox Malware Sync
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
All related ATT&CK context
No relationships are available in the current normalized data for this object.
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.