Log in Request a demo

Attack technique

Ingress Tool Transfer

Ingress Tool Transfer is a technique where attackers bring tools or other files from outside into a network they have already broken into.

In short

Ingress Tool Transfer is a technique where attackers bring tools or other files from outside into a network they have already broken into. The files are used for later steps of the attack. They can arrive through the attacker's control channel, FTP or other protocols, often using utilities the operating system already includes. MITRE ATT&CK tracks it as T1105.

Last updated 8 October 2026

Profile MapTechnique
  1. Reconnaissance
  2. Resource Development
  3. Initial Access
  4. Execution
  5. Persistence
  6. Privilege Escalation
  7. Stealth
  8. Defense Impairment
  9. Credential Access
  10. Discovery
  11. Lateral Movement
  12. Collection
  13. Command and Control
  14. Exfiltration
  15. Impact

Command and Control · Step 13 Of 15 In The Attack Chain

  1. MITRE IDT1105ATT&CK technique
  2. Detection4ways to spot itDetection strategy MITRE lists
  3. Defences2ways to stop itFilter outbound traffic

How it works

An attacker who has a foothold often needs more software than they started with. They copy tools or files from a system they control into the victim network. This can happen through the same channel they use to control the system, or through other protocols such as FTP.

Many operating systems already include utilities that can download files, so the attacker may not need to bring a downloader at all. Installers and package managers can also be abused to fetch tools.

Files can also arrive through web services or file sync services. Once inside, tools may be spread from one device to another within the network.

A real example

MITRE ATT&CK lists these procedure examples:

  • Agent Tesla can download additional files and run them on the victim machine.
  • Amadey can download and run files to infect a host with more malware.
  • AsyncRAT can download files, including over SFTP.

How to detect

  1. Unusual programs reaching outside

    Look for uncommon processes that connect to external destinations and then create files on the system.

  2. Download utilities followed by new files

    Watch for built-in transfer tools that connect to external domains and are followed by new executable files, especially in temporary or user folders.

  3. Odd transfers on network devices

    Network device logs may show unexpected inbound file transfers or flows with large payloads.

  4. Detection strategy MITRE lists

    DET0060, Detect Ingress Tool Transfers via Behavioral Chain.

How to defend

  1. Filter outbound traffic

    Block traffic from systems to unapproved external destinations and allow only trusted addresses and protocols, so tools are harder to download.

  2. Network intrusion detection and prevention

    Network signatures can help spot traffic from known malware or unusual data transfer over protocols like FTP. Attackers change these over time, so signatures alone are not enough.

Questions

What is Ingress Tool Transfer?

It is a technique where an attacker copies tools or files from a system they control into a victim network they have already entered. MITRE ATT&CK tracks it as T1105 under Command and Control.

How do attackers transfer tools into a network?

They can use the same channel they use to control the system, or other protocols such as FTP. Many operating systems include utilities that can download files, and installers, package managers, web services or file sync services can also be abused.

How can defenders detect Ingress Tool Transfer?

Look for uncommon processes that connect to external destinations and then create files. Watch for built-in transfer tools followed by new executable files in temporary or user folders, and for unexpected inbound transfers in network device logs.

How do you defend against Ingress Tool Transfer?

Filter outbound traffic so systems can reach only approved external destinations, which makes tools harder to download. Network intrusion detection can help, but attackers change their traffic over time, so signatures alone are not enough.

In our research

  1. ATT&CK groups by attributed origin: what is mapped October 2026
  2. ATT&CK techniques most used across threat groups October 2026
  3. APT38: From SWIFT Heists to Crypto Fortresses September 2025
  4. APT33 Threat Actors August 2022
  5. Dynamite Panda APT Group August 2022
  6. Fancy Bear APT Group August 2022

Sources

  1. MITRE ATT&CK T1105: Ingress Tool Transfer MITRE
  2. MITRE ATT&CK TA0011: Command and Control MITRE

Browse the threat library

Keep exploring

Knowledge Hub

Threat group

Andariel

Attributed by the US, UK and South Korean governments to North Korea's Reconnaissance General Bureau, Andariel is described in a July 2024 joint advisory as stealing defense, aerospace and nuclear secrets and funding that work with ransomware against US healthcare. MITRE ATT&CK describes it as a sub-set of Lazarus Group; the advisory does not use that term.

Read more

Threat group

APT-C-60

APT-C-60 is the name JPCERT/CC uses for a threat group it says likely carried out spear-phishing attacks on organizations in Japan from August 2024, using fake job-applicant emails and a backdoor called SpyGlace. No government or MITRE source opened for this page says who is behind it.

Read more