T1105 – Ingress Tool Transfer

Ingress Tool Transfer (T1105) describes adversaries transferring tools or other files from an external system into a compromised environment. The external source may be adversary-controlled infrastructure, a web or cloud service, or a command-and-control channel.

Copying tools between systems already inside the victim environment is normally Lateral Tool Transfer (T1570) , not another T1105 event. Classify each transfer according to where the file entered the environment and where it moved afterwards.

The technique describes movement of content, not successful execution and not maliciousness by itself.

• Tactic: Command and Control
• Sub-techniques: None

What I want to know

When reviewing a suspected transfer, I try to establish:

Common transfer paths

Initial delivery through email or messaging normally maps to T1566. Classify the activity as T1105 only when the transfer brings content from an external system into an already compromised environment.

The tool name is rarely the deciding fact. PowerShell, curl, browsers, package managers, and administration agents move legitimate content every day. The relationship between process, identity, source, destination, file, and next action is usually more discriminating.

Hunting ideas

Rare process-to-domain relationships

Find processes that contact domains they rarely use, then pivot to file creation by the same process and device. Preserve common downloaders rather than excluding them globally; a browser spawning an unusual child or writing an executable to an uncommon location can still matter.

Content written to staging paths

User profiles, temporary folders, public directories, recycle-bin paths, and writable application folders are useful starting points. They are also busy. Raise confidence with archive extraction, a low-prevalence hash, an unsigned executable, a misleading extension, or execution shortly after creation.

Transfer followed by execution

Sequence evidence over a realistic time window:

network or share access
        -> file creation or modification
        -> rename, extraction, or permission change
        -> process start
        -> persistence, discovery, credential access, or outbound activity

Do not require every stage. In-memory retrieval may have no file event, and a copied tool may be executed much later.

One source distributing to many systems

Distribution from one compromised internal host to other victim systems may represent T1570. The same shape can also indicate software deployment, administration, or an exercise. Establish where the file first entered the environment, then treat subsequent internal copies as separate transfer observations. Compare asset role, maintenance window, initiating identity, destination paths, hashes, remote service or task creation, and historical fan-out.

Defender XDR starting point

The query below looks for network activity from common transfer-capable processes. It deliberately remains a lead generator.

let TransferCapableProcesses = dynamic([
    "powershell.exe", "pwsh.exe", "curl.exe", "certutil.exe",
    "bitsadmin.exe", "mshta.exe", "wscript.exe", "cscript.exe"
]);
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName in~ (TransferCapableProcesses)
| project Timestamp,
          ReportId,
          ActionType,
          DeviceId,
          DeviceName,
          LocalIP,
          InitiatingProcessUniqueId,
          InitiatingProcessAccountUpn,
          InitiatingProcessFileName,
          InitiatingProcessCommandLine,
          RemoteUrl,
          RemoteIP,
          RemotePort
| order by Timestamp desc

Process-name filtering does not provide complete BITS coverage. BITS transfers may be attributed to the service rather than the command-line client that created the job. Correlate BITS job telemetry, service activity, and resulting file events where available.

Use DeviceId and the network event’s InitiatingProcessUniqueId. Match it to InitiatingProcessUniqueId in DeviceFileEvents, and to ProcessUniqueId in DeviceProcessEvents, using a tight time window. Validate the local schema and retention before assuming that every stage can be joined.

Reference: DeviceNetworkEvents schema .

False-positive families

• Software deployment and endpoint-management agents
• Package managers, build systems, and developer workflows
• Browser, email, and collaboration downloads
• Incident-response and red-team tooling
• Backup, migration, and file-synchronisation products
• Approved scripts retrieving configuration or updates

These are baseline categories, not blanket exclusions. An approved tool can be abused, and an approved transfer can still place a vulnerable or unwanted binary.

Investigation outcome

A useful conclusion distinguishes:

• Observed: the process connected to a source and a file with this hash appeared at this path.
• Supported inference: timing and identifiers make the connection the likely source of the file.
• Not established: whether the content executed or the operator intended harm.
• Next evidence: process creation, script content, archive handling, persistence, and destination prevalence.

Revision