Quick links
Press Enter to search, Esc to close
Attack technique
Ingress Tool Transfer is a technique where attackers bring tools or other files from outside into a network they have already broken into.
In short
Ingress Tool Transfer is a technique where attackers bring tools or other files from outside into a network they have already broken into. The files are used for later steps of the attack. They can arrive through the attacker's control channel, FTP or other protocols, often using utilities the operating system already includes. MITRE ATT&CK tracks it as T1105.
Command and Control · Step 13 Of 15 In The Attack Chain
An attacker who has a foothold often needs more software than they started with. They copy tools or files from a system they control into the victim network. This can happen through the same channel they use to control the system, or through other protocols such as FTP.
Many operating systems already include utilities that can download files, so the attacker may not need to bring a downloader at all. Installers and package managers can also be abused to fetch tools.
Files can also arrive through web services or file sync services. Once inside, tools may be spread from one device to another within the network.
MITRE ATT&CK lists these procedure examples:
Look for uncommon processes that connect to external destinations and then create files on the system.
Watch for built-in transfer tools that connect to external domains and are followed by new executable files, especially in temporary or user folders.
Network device logs may show unexpected inbound file transfers or flows with large payloads.
DET0060, Detect Ingress Tool Transfers via Behavioral Chain.
Block traffic from systems to unapproved external destinations and allow only trusted addresses and protocols, so tools are harder to download.
Network signatures can help spot traffic from known malware or unusual data transfer over protocols like FTP. Attackers change these over time, so signatures alone are not enough.
It is a technique where an attacker copies tools or files from a system they control into a victim network they have already entered. MITRE ATT&CK tracks it as T1105 under Command and Control.
They can use the same channel they use to control the system, or other protocols such as FTP. Many operating systems include utilities that can download files, and installers, package managers, web services or file sync services can also be abused.
Look for uncommon processes that connect to external destinations and then create files. Watch for built-in transfer tools followed by new executable files in temporary or user folders, and for unexpected inbound transfers in network device logs.
Filter outbound traffic so systems can reach only approved external destinations, which makes tools harder to download. Network intrusion detection can help, but attackers change their traffic over time, so signatures alone are not enough.
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.
