T1105Command and Controlmedium difficulty

Ingress Tool Transfer

Ingress Tool Transfer is the adversary pulling additional tools into the victim environment from outside, over the C2 channel or a side protocol such as FTP. On Windows it often abuses trusted built-ins, certutil, bitsadmin, mshta, and PowerShell download cradles, so the download resembles normal administration. Analysts flag these living-off-the-land binaries fetching from remote URLs, files written to disk right after an outbound connection, and downloads from newly registered or low-reputation domains.

Practice detecting Ingress Tool Transfer on realistic Firewall, XDR, SIEM alerts in SOCSimulator Operations.

FirewallXDRSIEM

View T1105 on MITRE ATT&CK®

What is Ingress Tool Transfer?

“Ingress Tool Transfer is documented as technique T1105 in MITRE ATT&CK® v19.1 under the Command and Control tactic. Detection requires visibility into Firewall, XDR, SIEM telemetry.”
— MITRE ATT&CK® v19.1 (2026)

Detection Strategies

The following detection strategies help SOC analysts identify Ingress Tool Transfer activity. These methods apply across Firewall, XDR, SIEM environments and can be implemented as detection rules, correlation queries, or behavioral analytics in your security platform.

1
Monitor Windows built-in utilities being used for file download including certutil -urlcache, bitsadmin /transfer, mshta downloading from remote URLs, and regsvr32 pointing to remote scripts.
2
Alert on PowerShell Invoke-WebRequest, wget, and curl commands downloading content from external URLs, particularly when the destination file is saved to executable paths or subsequently executed.
3
Detect downloads from suspicious sources including newly registered domains, domains using dynamic DNS, free hosting services, and paste site URLs which are commonly used to host malware payloads.
4
Monitor network connections from unusual processes to external IP addresses, particularly when the connection results in a file being written to disk and then executed within a short time window.
5
Track file creation events on web servers and other internet-connected systems for executable files being written by web server processes, which may indicate web shell uploads or remote code execution.

Example Alerts

These realistic alert examples show what Ingress Tool Transfer looks like in your security tools. Use them to tune detection rules and train analysts to recognize true positives versus false positives in live environments.

HighXDR

Certutil Used to Download Malware

Certutil.exe executed with -urlcache -split -f parameters downloading a file named "update.cer" from 45.142.212.100. Despite the .cer extension, file analysis confirms the downloaded content is a PE executable. Certutil is commonly used as a living-off-the-land binary for malware download because it is trusted and available on all Windows systems, often whitelisted by application control policies.

CriticalXDR

PowerShell Download Cradle Execution

PowerShell executed with IEX (Invoke-Expression) and Invoke-WebRequest downloading a script from raw.githubusercontent.com and executing it in memory without writing to disk. The GitHub account hosting the payload was created 2 hours before the download. The in-memory execution avoids file-based detection and the use of GitHub makes the connection appear legitimate to network controls.

HighSIEM

Malware Downloaded via BITS Job

BITS service created a background transfer job downloading content from an external URL to C:\Windows\Temp\svchost32.exe. BITS jobs persist across reboots and run as SYSTEM, making this technique effective for both tool transfer and persistence. The destination filename mimics a legitimate Windows process. The source URL resolves to a VPS hosting provider with no legitimate business relationship to the organization.

Frequently Asked Questions

How do SOC analysts detect Ingress Tool Transfer?: Detection centers on Firewall, XDR, SIEM telemetry for the command and control phase of the attack. Monitor Windows built-in utilities being used for file download including certutil -urlcache, bitsadmin /transfer, mshta downloading from remote URLs, and regsvr32 pointing to remote scripts. Alert on PowerShell Invoke-WebRequest, wget, and curl commands downloading content from external URLs, particularly when the destination file is saved to executable paths or subsequently executed.
What does a Ingress Tool Transfer alert look like?: A representative XDR detection is "Certutil Used to Download Malware" (high severity): Certutil.exe executed with -urlcache -split -f parameters downloading a file named "update.cer" from 45.142.212.100. Despite the .cer extension, file analysis confirms the downloaded content is a PE executable. Certutil is commonly used as a living-off-the-land binary for malware download because it is trusted and available on all Windows systems, often whitelisted by application control policies.
Which tools detect Ingress Tool Transfer, and how can I practice?: Ingress Tool Transfer (T1105) is best surfaced with Firewall, XDR, SIEM telemetry, which exposes the command and control signals described above. Practice detecting it on those exact consoles in SOCSimulator Operations, free.

Practice Ingress Tool Transfer in a Free Room

Investigate Ingress Tool Transfer on realistic SIEM, XDR, and firewall consoles, free.

Bumblebee Returns: The Voicemail VBA Macro

An accounts-payable clerk opened a voicemail-notification email, followed a OneDrive link, and a Word macro quietly pulled a loader onto the host. Follow the chain from a sender-spoofed phishing message through a VBA macro, PowerShell, and signed-binary proxy execution to the Bumblebee loader's TLS command-and-control.

30m·257 tasks

View Operation

Hijacked Discord Invite to ClickFix Loader: Tracing the Lure

A finance analyst at Halcyon Wealth Partners followed a recycled Discord invite that quietly redirected the browser to a fake verification page. They did what the page asked, and inside the hour the workstation was running a remote-access trojan alongside an info-stealer that shipped browser data straight out of the building. Walk the proxy, endpoint and firewall evidence step by step to trace the lure, the loader, the C2 beacon and the data theft.

15m·257 tasks

View Operation

CI/CD Pipeline Hijack: GitHub Actions Compromise

Investigate the March 2025 GitHub Actions supply-chain compromise involving tj-actions/changed-files and reviewdog/action-setup. A compromised action version tag caused Linux CI runners to execute malicious payload logic and expose CI/CD secrets in workflow logs using double-base64 encoding. Analyze SIEM and XDR telemetry to identify the affected action, runner identity, payload execution, detection source, and secret-exposure pattern, then decide which artifacts are malicious versus benign threat-intelligence lookups.

50m·508 tasks

View Operation

Glossary

Ingress Tool Transfer

What is Ingress Tool Transfer?

Detection Strategies