T1105: Ingress Tool Transfer

ATT&CK Mapping

Field	Value
Technique ID	T1105
Name	Ingress Tool Transfer
Tactic	Command and Control (command-and-control)
Platforms	ESXi, Linux, macOS, Network Devices, Windows
Sub-technique	No

Why it matters

In the OpenTrojan knowledge graph, Ingress Tool Transfer (T1105) is one of the highest-connectivity ATT&CK techniques: 520 MITRE STIX relationships reference this technique; 88 threat groups observed using it; 403 software families associated; 29 campaigns associated; 49 OpenTrojan content pages reference it. These counts are derived from MITRE ATT&CK STIX relationships and are not an estimate of exploitation volume.

How attackers use it

Behavior described below is from the MITRE ATT&CK canonical definition (source: https://attack.mitre.org/techniques/T1105). Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp. Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer). On Windows, adversaries may use various utilities to download tools, such as copy, finger, certutil, and PowerShell commands such as IEX(New-Object Net.WebClient).downloadString() and Invoke-WebRequest. On Linux and macOS systems, a variety of utilities also exist, such as curl, scp, sftp, tftp, rsync, finger, and wget. A number of these tools, such as wget, curl, and scp, also exist on ESXi. After downloading a file, a threat actor may attempt to verify its integrity by checking its hash value (e.g., via certutil -hashfile). Adversaries may also abuse installers and package managers, such as yum or winget, to download tools to victim hosts. Adversaries have also abused file application features, such as the Windows search-ms protocol handler, to deliver malicious files to victims through remote file searches invoked by User Execution (typically after interacting with Phishing lures). Files can also be transferred using various Web Services as well as native or otherwise present tools on the victim system. In some cases, adversaries may be able to leverage services that sync between a web-based and an on-premises client, such as Dropbox or OneDrive, to transfer files onto victim systems. For example, by compromising a cloud account and logging into the service’s web portal, an adversary may be able to trigger an automatic syncing process that transfers the file onto the victim’s machine.

Detection

DET0060 Detect Ingress Tool Transfers via Behavioral Chain AN0165 Unusual or uncommon processes initiate network connections to external destinations followed by file creation (tools downloaded). AN0166 Shell-based tools (curl, wget, scp) initiate connections to external domains followed by creation of executable files on disk. AN0167 Process execution of curl or wget followed by a network connection and a file created in temporary or user-specific directories. AN0168 Command line interface or vCLI triggers remote transfer using wget or curl, writing files into datastore paths or local tmp directories. AN0169 Network device logs show anomalous inbound file transfers or uncharacteristic flows with high payload volume to network devices with storage or automation hooks.

Detection strategy text is from the MITRE ATT&CK official technique page (https://attack.mitre.org/techniques/T1105).

Mitigation

Use intrusion detection signatures to block traffic at network boundaries.

Mitigation guidance is from the MITRE ATT&CK course-of-action associated with this technique.

Related Software

• TrickBot
• PowerDuke
• BLINDINGCAN
• Wiarp
• RCSession
• QuietSieve
• Bumblebee
• BRICKSTORM
• Amadey
• NICECURL
• Orz
• NOKKI

Software associations are from MITRE ATT&CK STIX relationships (observed usage, not attribution).

Related Threat Groups

• APT38
• Indrik Spider
• BlackByte
• Elderwood
• SideCopy
• GALLIUM
• APT3
• Mustard Tempest
• Kimsuky
• Volt Typhoon
• Patchwork
• APT41

Group associations are from MITRE ATT&CK STIX relationships.

Related Campaigns

• Operation Dream Job
• KV Botnet Activity
• SharePoint ToolShell Exploitation
• Frankenstein
• RedPenguin
• Operation Sharpshooter
• Operation Honeybee
• Operation MidnightEclipse
• 2015 Ukraine Electric Power Attack
• Cutting Edge
• C0018
• Water Curupira Pikabot Distribution

Campaign associations are from MITRE ATT&CK STIX relationships.

Related Content

• APT12
• APT16
• APT24
• APT25
• APT27
• APT32

References

• https://attack.mitre.org/techniques/T1105
• https://www.trellix.com/blogs/research/beyond-file-search-a-novel-method
• https://cloud.google.com/blog/topics/threat-intelligence/cosmicenergy-ot-malware-russian-response
• https://www.technologyreview.com/2013/08/21/83143/dropbox-and-similar-services-can-sync-malware
• https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf
• https://lolbas-project.github.io/#t1105
• https://www.ptsecurity.com/upload/corporate/ww-en/analytics/Cobalt-Snatch-eng.pdf