Detect Ingress Tool Transfer in CrowdStrike LogScale
Adversaries may transfer tools or other files from an external system into a compromised environment. Tools may be pulled via the C2 channel or through alternate protocols using built-in OS utilities (certutil, bitsadmin, PowerShell Invoke-WebRequest, curl, wget, scp). Threat actors including HAFNIUM, Fox Kitten, and Cobalt Group have leveraged this technique to stage second-stage payloads, implants, and post-exploitation toolkits onto victim systems.
MITRE ATT&CK
- Tactic
- Command and Control
- Technique
- T1105 Ingress Tool Transfer
- Canonical reference
- https://attack.mitre.org/techniques/T1105/
LogScale Detection Query
// Branch 1: LOLBin and PowerShell download activity (ProcessRollup2)
(
#event_simpleName = ProcessRollup2
OR #event_simpleName = SyntheticProcessRollup2
)
| case {
FileName = /(?i)^certutil\.exe$/ AND CommandLine = /(?i)(-urlcache|-decode|-decodehex|-verifyctl)/
| DetectionType := "certutil_download" ;
FileName = /(?i)^bitsadmin\.exe$/ AND CommandLine = /(?i)(\/transfer|\/addfile|\/setnotifycmdline)/
| DetectionType := "bitsadmin_download" ;
FileName = /(?i)^(powershell|pwsh)\.exe$/ AND CommandLine = /(?i)(invoke-webrequest|net\.webclient|downloadfile|downloaddata|downloadstring|start-bitstransfer|webclient|httpclient|webrequest\.create)/ AND CommandLine = /(?i)https?:\/\//
| DetectionType := "ps_download_cradle" ;
FileName = /(?i)^(curl|wget)\.exe$/ AND CommandLine = /(?i)https?:\/\//
| DetectionType := "curl_wget_download" ;
FileName = /(?i)^(wscript|cscript)\.exe$/ AND CommandLine = /(?i)(https?:\/\/|ftp:\/\/)/
| DetectionType := "wscript_download" ;
FileName = /(?i)^(desktopimgdownldr|esentutl|expand|extrac32|finger|ftp|ieexec|mshta|xcopy)\.exe$/ AND CommandLine = /(?i)(https?:\/\/|ftp:\/\/)/
| DetectionType := "lolbin_download" ;
*
| drop()
}
| table([_time, ComputerName, UserName, FileName, CommandLine, ParentBaseFileName, DetectionType])
| sort(field=_time, order=desc)
// Branch 2: Executable files written to suspicious paths by download utilities (PeFileWritten)
// Run separately and union with Branch 1 results as needed
// #event_simpleName = PeFileWritten OR #event_simpleName = SuspiciousWriteOfExecutable
// | TargetFileName = /(?i)(\\temp\\|\\appdata\\|\\programdata\\|\\users\\public\\)/
// | TargetFileName = /(?i)\.(exe|dll|ps1|vbs|bat|hta|scr|msi)$/
// | ImageFileName = /(?i)(certutil|bitsadmin|powershell|pwsh|curl|wget|mshta|wscript|cscript)\.exe$/
// | table([_time, ComputerName, UserName, ImageFileName, TargetFileName])CrowdStrike Falcon LogScale (CQL) detection for T1105 Ingress Tool Transfer. Queries ProcessRollup2 and SyntheticProcessRollup2 events from the Falcon sensor using case-based regex matching across six detection branches: certutil download flags, bitsadmin transfer commands, PowerShell/pwsh download cradles, curl/wget HTTP invocations, wscript/cscript with external URLs, and other LOLBin utilities with network protocol strings. A commented secondary branch targets PeFileWritten events for executable drops in suspicious paths. Uses Falcon event field names: FileName, CommandLine, ComputerName, UserName, ParentBaseFileName.
Data Sources
Required Tables
False Positives & Tuning
- Falcon sensor itself and CrowdStrike update infrastructure may trigger on certutil or bitsadmin if the endpoint's existing software deployment tooling uses these utilities to stage approved installers during patch cycles
- Software development tools on engineer endpoints — particularly .NET SDK, NuGet CLI, or PowerShell module installation scripts that call Invoke-WebRequest or DownloadFile to fetch packages from public registries such as PowerShell Gallery or NuGet.org
- Remote monitoring and management (RMM) tools such as ConnectWise Automate, Kaseya VSA, or Datto RMM that use PowerShell scripts with WebClient or BITS transfer to deploy scripts and agents to managed endpoints — activity that may appear identical to adversarial download cradles
Other platforms for T1105
Testing Methodology
Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Certutil URL Cache Download
Expected signal: Sysmon Event ID 1: Process Create with Image=certutil.exe, CommandLine containing '-urlcache -split -f http://'. Sysmon Event ID 3: Network Connection from certutil.exe to 127.0.0.1:8080. Sysmon Event ID 11: File Create at %TEMP%\df00tech-test.exe with InitiatingProcessImage=certutil.exe. Security Event ID 4688 if command line auditing is enabled.
- Test 2BitsAdmin File Transfer
Expected signal: Sysmon Event ID 1: Process Create with Image=bitsadmin.exe, CommandLine containing '/transfer' and '/download'. Sysmon Event ID 3: Network Connection from bitsadmin.exe to 127.0.0.1:8080. Microsoft-Windows-Bits-Client/Operational Event ID 3 (job created) and Event ID 59 (transfer complete) if the server responds. Sysmon Event ID 11 for file creation if download succeeds.
- Test 3PowerShell Invoke-WebRequest File Download
Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing 'Invoke-WebRequest' and '-OutFile'. Sysmon Event ID 3: Network Connection from powershell.exe to 127.0.0.1:8080. Sysmon Event ID 11: File Create at %TEMP%\df00tech-iwr.exe. PowerShell ScriptBlock Log Event ID 4104 with full cmdlet and parameters.
- Test 4Certutil Encode-then-Decode Two-Stage Transfer
Expected signal: Two Sysmon Event ID 1 entries: first for certutil.exe -encode, second for certutil.exe -decode. Both events will have CommandLine containing 'certutil.exe' and temp path arguments. The -decode invocation is the targeted indicator. Security Event IDs 4688 for both invocations if command line auditing is enabled.
- Test 5Linux curl Download to /tmp
Expected signal: Auditd syscall records for execve of curl with arguments including '-o /tmp/'. Syslog or auditd file creation record for /tmp/df00tech-test-payload. If auditd rules monitor /tmp writes (WATCH -w /tmp -p w), an auditd WATCH event fires. If endpoint agent (Falcon, Defender for Linux) is present, a process creation event with curl and -o /tmp argument is generated.
References (11)
- https://attack.mitre.org/techniques/T1105/
- https://lolbas-project.github.io/#t1105
- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/certutil
- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/bitsadmin-transfer
- https://cloud.google.com/blog/topics/threat-intelligence/cosmicenergy-ot-malware-russian-response/
- https://www.trellix.com/blogs/research/beyond-file-search-a-novel-method/
- https://www.technologyreview.com/2013/08/21/83143/dropbox-and-similar-services-can-sync-malware/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1105/T1105.md
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_certutil_download.yml
- https://www.mandiant.com/resources/blog/hafnium-china-cyberespionage-exchange-server
- https://www.ptsecurity.com/upload/corporate/ww-en/analytics/Cobalt-Snatch-eng.pdf
Unlock Pro Content
Get the full detection package for T1105 including response playbook, investigation guide, and atomic red team tests.