T1105 Elastic Security · Elastic

Detect Ingress Tool Transfer in Elastic Security

Adversaries may transfer tools or other files from an external system into a compromised environment. Tools may be pulled via the C2 channel or through alternate protocols using built-in OS utilities (certutil, bitsadmin, PowerShell Invoke-WebRequest, curl, wget, scp). Threat actors including HAFNIUM, Fox Kitten, and Cobalt Group have leveraged this technique to stage second-stage payloads, implants, and post-exploitation toolkits onto victim systems.

MITRE ATT&CK

Tactic
Command and Control
Technique
T1105 Ingress Tool Transfer
Canonical reference
https://attack.mitre.org/techniques/T1105/

Elastic Detection Query

Elastic Security (Elastic)
eql 
any where
(
  event.category == "process" and event.type == "start" and
  (
    (
      process.name in~ ("certutil.exe", "bitsadmin.exe", "mshta.exe", "desktopimgdownldr.exe", "esentutl.exe", "expand.exe", "extrac32.exe", "finger.exe", "ftp.exe", "ieexec.exe", "wscript.exe", "xcopy.exe") and
      (
        process.command_line like~ "*http://*" or
        process.command_line like~ "*https://*" or
        process.command_line like~ "*ftp://*"
      )
    ) or
    (
      process.name == "certutil.exe" and
      (
        process.command_line like~ "*-urlcache*" or
        process.command_line like~ "*-decode*" or
        process.command_line like~ "*-decodehex*" or
        process.command_line like~ "*-verifyctl*"
      )
    ) or
    (
      process.name == "bitsadmin.exe" and
      (
        process.command_line like~ "*/transfer*" or
        process.command_line like~ "*/addfile*" or
        process.command_line like~ "*/setnotifycmdline*"
      )
    ) or
    (
      process.name in~ ("powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe") and
      (
        process.command_line like~ "*Invoke-WebRequest*" or
        process.command_line like~ "*Net.WebClient*" or
        process.command_line like~ "*DownloadFile*" or
        process.command_line like~ "*DownloadData*" or
        process.command_line like~ "*Start-BitsTransfer*" or
        process.command_line like~ "*WebRequest.Create*" or
        process.command_line like~ "*HttpClient*"
      ) and
      (
        process.command_line like~ "*http://*" or
        process.command_line like~ "*https://*"
      )
    ) or
    (
      process.name in~ ("curl.exe", "wget.exe") and
      (
        process.command_line like~ "*http://*" or
        process.command_line like~ "*https://*"
      )
    )
  )
) or
(
  event.category == "file" and
  event.type == "creation" and
  (
    file.path like~ "*\\Temp\\*" or
    file.path like~ "*\\AppData\\Local\\Temp\\*" or
    file.path like~ "*\\AppData\\Roaming\\*" or
    file.path like~ "*\\Users\\Public\\*" or
    file.path like~ "*\\ProgramData\\*" or
    file.path like~ "*\\Windows\\Temp\\*"
  ) and
  file.extension in~ ("exe", "dll", "ps1", "vbs", "bat", "cmd", "hta", "scr", "bin", "msi") and
  process.name in~ ("certutil.exe", "bitsadmin.exe", "powershell.exe", "pwsh.exe", "curl.exe", "wget.exe", "wscript.exe", "cscript.exe", "mshta.exe")
)
high severity high confidence

Detects ingress tool transfer via three correlated branches: (1) LOLBin utilities executing with HTTP/FTP URLs or tool-specific download flags (certutil -urlcache, bitsadmin /transfer); (2) PowerShell and script interpreter download cradles referencing WebClient, Invoke-WebRequest, or BITS methods with external URLs; (3) executable or script files written to suspicious temporary paths by known download utilities. Uses Elastic Common Schema process and file event categories.

Data Sources

Elastic Endpoint Security agent (logs-endpoint.events.process-*, logs-endpoint.events.file-*)Winlogbeat with Sysmon module (winlogbeat-*) — requires Sysmon EventIDs 1 and 11Elastic Agent integration with Windows Security auditing (process command line logging enabled)

Required Tables

logs-endpoint.events.process-*logs-endpoint.events.file-*winlogbeat-*

False Positives & Tuning

  • SCCM, Intune, PDQ Deploy, or Chocolatey package managers invoking certutil.exe or bitsadmin.exe to pull signed installers from internal distribution points or vendor CDNs
  • CI/CD pipeline agents (Jenkins, GitHub Actions runner, TeamCity) running PowerShell scripts that use Invoke-WebRequest or curl.exe to download build artifacts from trusted artifact repositories such as Artifactory or Nexus
  • IT administrators executing approved patch management scripts that download Windows updates, agent installers, or security tooling from vendor HTTPS endpoints during scheduled maintenance windows
Download portable Sigma rule (.yml)

Other platforms for T1105

Microsoft Sentinel (KQL) Splunk (SPL) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Certutil URL Cache Download

    Expected signal: Sysmon Event ID 1: Process Create with Image=certutil.exe, CommandLine containing '-urlcache -split -f http://'. Sysmon Event ID 3: Network Connection from certutil.exe to 127.0.0.1:8080. Sysmon Event ID 11: File Create at %TEMP%\df00tech-test.exe with InitiatingProcessImage=certutil.exe. Security Event ID 4688 if command line auditing is enabled.

  2. Test 2BitsAdmin File Transfer

    Expected signal: Sysmon Event ID 1: Process Create with Image=bitsadmin.exe, CommandLine containing '/transfer' and '/download'. Sysmon Event ID 3: Network Connection from bitsadmin.exe to 127.0.0.1:8080. Microsoft-Windows-Bits-Client/Operational Event ID 3 (job created) and Event ID 59 (transfer complete) if the server responds. Sysmon Event ID 11 for file creation if download succeeds.

  3. Test 3PowerShell Invoke-WebRequest File Download

    Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing 'Invoke-WebRequest' and '-OutFile'. Sysmon Event ID 3: Network Connection from powershell.exe to 127.0.0.1:8080. Sysmon Event ID 11: File Create at %TEMP%\df00tech-iwr.exe. PowerShell ScriptBlock Log Event ID 4104 with full cmdlet and parameters.

  4. Test 4Certutil Encode-then-Decode Two-Stage Transfer

    Expected signal: Two Sysmon Event ID 1 entries: first for certutil.exe -encode, second for certutil.exe -decode. Both events will have CommandLine containing 'certutil.exe' and temp path arguments. The -decode invocation is the targeted indicator. Security Event IDs 4688 for both invocations if command line auditing is enabled.

  5. Test 5Linux curl Download to /tmp

    Expected signal: Auditd syscall records for execve of curl with arguments including '-o /tmp/'. Syslog or auditd file creation record for /tmp/df00tech-test-payload. If auditd rules monitor /tmp writes (WATCH -w /tmp -p w), an auditd WATCH event fires. If endpoint agent (Falcon, Defender for Linux) is present, a process creation event with curl and -o /tmp argument is generated.

Last updated: 2026-04-17 Research depth: deep
References (11)

Unlock Pro Content

Get the full detection package for T1105 including response playbook, investigation guide, and atomic red team tests.

Response PlaybookInvestigation GuideHunting QueriesAtomic Red Team TestsTuning Guidance
Sign Up for Pro View Pricing

Related Detections

Related Techniques

T1059.001PowerShellT1059.003Windows Command ShellT1059.004Unix ShellT1027Obfuscated Files or InformationT1140Deobfuscate/Decode Files or InformationT1197BITS JobsT1570Lateral Tool TransferT1566PhishingT1204User ExecutionT1102Web ServiceT1071.001Web ProtocolsT1608Stage Capabilities

Same Tactic: Command and Control

Popular Detections