T1105 Ingress Tool Transfer
Adversaries may transfer tools or other files from an external system into a compromised environment. MITRE ATT&CK
85 programs on CmdID 57 Sigma rules T1105 on attack.mitre.org
Programs for it
abdownloadappinstaller.exeDownloadaria2cdownloadbashdownloadbcp.exeDownloadbitsadmin.exeDownloadcertoc.exeDownloadcertreq.exeDownloadcertutil.exeDownloadcmd.exeDownloadcmdl32.exeDownloadcodedownloadconfigsecuritypolicy.exeDownloadcurldownloaddesktopimgdownldr.exeDownloaddevtunnel.exeDownloaddiantz.exeDownloaddtutil.exeCopyecmangen.exeDownloadesentutl.exeCopyexcel.exeDownloadexpand.exeDownloadextrac32.exeDownloadfindstr.exeDownloadfinger.exeDownloadftpdownloadftp.exeDownloadhh.exeDownloadieexec.exeDownloadimewdbld.exeDownloadinstallutil.exeDownloadjrunscriptdownloadjuliadownloadkshdownloadldifde.exeDownloadluadownloadmakecab.exeDownloadmpcmdrun.exeDownloadmsaccess.exeDownloadmsdeploy.exeCopymsedge.exeDownloadmsedge_proxy.exeDownloadmshta.exeDownloadmsohtmed.exeDownloadmsoxmled.exeDownloadmspub.exeDownloadmsxsl.exeDownloadncdownloadngen.exeDownloadnginxdownloadnodedownloadonedrivestandaloneupdater.exeDownloadopenssldownloadoutlook.exeDownloadperldownloadphotoviewer.dllDownloadphpdownloadpowerpnt.exeDownloadpresentationhost.exeDownloadprint.exeCopyprintbrm.exeDownloadprotocolhandler.exeDownloadpythondownloadreplace.exeCopyrubydownloadrundll32.exeDownloadscrobj.dllDownloadshimgvw.dllDownloadsmbclientdownloadsocatdownloadtardownloadtar.exeCopyvisio.exeDownloadvslaunchbrowser.exeDownloadwgetdownloadwhoisdownloadwinget.exeExecutewinproj.exeDownloadwinword.exeDownloadwmic.exeCopywsl.exeDownloadxsd.exeDownloadxwizard.exeDownloadyumdownloadzshdownloadSigma rules tagged with it
highAxios NPM Compromise Indicators - WindowsSwachchhanda Shrawan Poudel (Nextron Systems) · Windows
highCurl Download And Execute CombinationSreeman, Nasreddine Bencherchali (Nextron Systems) · Windows
highFile Download From IP Based URL Via CertOC.EXENasreddine Bencherchali (Nextron Systems) · Windows
highFile Download Via Bitsadmin To A Suspicious Target FolderFlorian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) · Windows
highFile With Suspicious Extension Downloaded Via BitsadminFlorian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) · Windows
highPotential Exploitation of RCE Vulnerability CVE-2025-33053Swachchhanda Shrawan Poudel (Nextron Systems) · Windows
highSuspicious Curl.EXE DownloadFlorian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) · Windows
highSuspicious Download From File-Sharing Website Via BitsadminFlorian Roth (Nextron Systems) · Windows
highSuspicious Download from Office DomainFlorian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) · Windows
highSuspicious File Downloaded From Direct IP Via Certutil.EXENasreddine Bencherchali (Nextron Systems) · Windows
highSuspicious File Downloaded From File-Sharing Website Via Certutil.EXENasreddine Bencherchali (Nextron Systems) · Windows
mediumCommand Line Execution with Suspicious URL and AppData StringsFlorian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community · Windows
mediumDownload File To Potentially Suspicious Directory Via WgetJoseliyo Sanchez, @Joseliyo_Jstnk · Linux
mediumFile Download From Browser Process Via Inline URLFlorian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) · Windows
mediumPotential Data Exfiltration Via Curl.EXEFlorian Roth (Nextron Systems), Cedric MAURUGEON (Update) · Windows
mediumPotential DLL File Download Via PowerShell Invoke-WebRequestFlorian Roth (Nextron Systems), Hieu Tran · Windows
mediumPotential Download/Upload Activity Using Type CommandNasreddine Bencherchali (Nextron Systems) · Windows
mediumPotential In-Memory Download And Compile Of PayloadsSohan G (D4rkCiph3r), Red Canary (idea) · macOS
mediumPotential Pikabot Infection - Suspicious Command Combinations Via Cmd.EXEAlejandro Houspanossian ('@lekz86') · Windows
mediumPowerShell MSI Install via WindowsInstaller COM From Remote LocationMeroujan Antonyan (vx3r) · Windows
mediumRemote Access Tool - TacticalRMM Agent Registration to Potentially Attacker-Controlled ServerAhmed Nosir (@egycondor) · Windows
mediumRemote File Download Via Findstr.EXEFurkan CALISKAN, @caliskanfurkan_, @oscd_initiative, Nasreddine Bencherchali (Nextron Systems) · Windows
mediumScheduled Task Creation with Curl and PowerShell Execution ComboSwachchhanda Shrawan Poudel (Nextron Systems) · Windows
mediumSuspicious Curl File Upload - LinuxNasreddine Bencherchali (Nextron Systems), Cedric MAURUGEON (Update) · Linux
mediumSuspicious Download Via Certutil.EXEFlorian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community, Nasreddine Bencherchali (Nextron Systems) · Windows
mediumSuspicious Invoke-WebRequest Execution With DirectIPNasreddine Bencherchali (Nextron Systems) · Windows
lowInsensitive Subfolder Search Via Findstr.EXEFurkan CALISKAN, @caliskanfurkan_, @oscd_initiative, Nasreddine Bencherchali (Nextron Systems) · Windows
Command lines CmdID reads as it
Make an HTTP GET request and dump the contents in stdout on the page for curl
curl https://example.comIdentifyMake an HTTP GET request, follow any 3xx redirects, and dump the reply headers and contents to stdout on the page for curl
curl --location --dump-header - https://example.comIdentifyDownload a file, saving the output under the filename indicated by the URL on the page for curl
curl --remote-name https://example.com/filename.zipIdentifyDisplay information about a specific user on the page for finger.exe
finger user@hostIdentifyDisplay information about all users on the specified host on the page for finger.exe
finger @hostIdentifyDisplay information in a longer format on the page for finger.exe
finger user@host -lIdentifyOpen a specific URL or file on the page for msedge.exe
msedge https://example.comIdentifyAdd files to the destination directory instead of replacing existing files on the page for replace.exe
replace path\to\file_or_directory path\to\destination_directory /aIdentifyTo add a file to the job on the page for bitsadmin addfile
bitsadmin /addfile myDownloadJob http://downloadsrv/10mb.zip c:\10mb.zipIdentifyTo start a transfer job named myDownloadJob on the page for bitsadmin transfer
bitsadmin /transfer myDownloadJob http://prodserver/audio.wma c:\downloads\audio.wmaIdentifyAnd 12 more examples on CmdID’s program pages.
An example is here when CmdID’s reading of it names T1105: a Sigma rule it trips is tagged with it, or its abuse is documented as it.