Detect Ingress Tool Transfer in Microsoft Sentinel
Adversaries may transfer tools or other files from an external system into a compromised environment. Tools may be pulled via the C2 channel or through alternate protocols using built-in OS utilities (certutil, bitsadmin, PowerShell Invoke-WebRequest, curl, wget, scp). Threat actors including HAFNIUM, Fox Kitten, and Cobalt Group have leveraged this technique to stage second-stage payloads, implants, and post-exploitation toolkits onto victim systems.
MITRE ATT&CK
- Tactic
- Command and Control
- Technique
- T1105 Ingress Tool Transfer
- Canonical reference
- https://attack.mitre.org/techniques/T1105/
KQL Detection Query
let DownloadLolbins = dynamic(["certutil.exe", "bitsadmin.exe", "mshta.exe", "regsvr32.exe", "desktopimgdownldr.exe", "esentutl.exe", "expand.exe", "extrac32.exe", "finger.exe", "ftp.exe", "ieexec.exe", "makecab.exe", "mavinject.exe", "msiexec.exe", "replace.exe", "robocopy.exe", "wscript.exe", "xcopy.exe"]);
let SuspiciousExtensions = dynamic([".exe", ".dll", ".ps1", ".vbs", ".bat", ".cmd", ".hta", ".scr", ".bin", ".msi", ".jar"]);
let SuspiciousDownloadPaths = dynamic(["\\Temp\\", "\\AppData\\Local\\Temp\\", "\\AppData\\Roaming\\", "\\Users\\Public\\", "\\ProgramData\\", "\\Windows\\Temp\\"]);
// Branch 1: LOLBin download activity
let LolbinDownloads = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ (DownloadLolbins)
| where ProcessCommandLine has_any ("http://", "https://", "ftp://", "\\\\")
or (FileName =~ "certutil.exe" and ProcessCommandLine has_any ("-urlcache", "-decode", "-decodehex", "-verifyctl"))
or (FileName =~ "bitsadmin.exe" and ProcessCommandLine has_any ("/transfer", "/addfile", "/setnotifycmdline"))
or (FileName =~ "esentutl.exe" and ProcessCommandLine has "/cp")
or (FileName =~ "desktopimgdownldr.exe" and ProcessCommandLine has "--storagefile")
| extend DetectionSource = "LOLBin download"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
InitiatingProcessFileName, InitiatingProcessCommandLine, DetectionSource;
// Branch 2: PowerShell / WScript download cradles (distinct from T1059.001 focus)
let PsDownloads = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe")
| where ProcessCommandLine has_any (
"Invoke-WebRequest", "IWR ", "Start-BitsTransfer",
"Net.WebClient", "DownloadFile", "DownloadData",
"WebRequest.Create", "HttpClient", "OpenRead",
"wget ", "curl "
)
| where ProcessCommandLine has_any ("http://", "https://", "ftp://")
| extend DetectionSource = "PowerShell/script download cradle"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
InitiatingProcessFileName, InitiatingProcessCommandLine, DetectionSource;
// Branch 3: Executable files created in suspicious paths following network activity
let ExecFilesInTempPaths = DeviceFileEvents
| where Timestamp > ago(24h)
| where ActionType =~ "FileCreated"
| where FolderPath has_any (SuspiciousDownloadPaths)
| where FileName has_any (SuspiciousExtensions)
| where InitiatingProcessFileName in~ (DownloadLolbins)
or InitiatingProcessFileName in~ ("powershell.exe", "pwsh.exe", "curl.exe", "wget.exe", "wscript.exe", "cscript.exe", "mshta.exe")
| extend DetectionSource = "Executable dropped in temp path by download utility"
| project Timestamp, DeviceName, InitiatingProcessAccountName as AccountName,
FileName, FolderPath, InitiatingProcessFileName,
InitiatingProcessCommandLine, DetectionSource;
// Union all branches
LolbinDownloads
| union PsDownloads
| union ExecFilesInTempPaths
| sort by Timestamp descDetects ingress tool transfer activity across three signal branches using Microsoft Defender for Endpoint telemetry. Branch 1 identifies LOLBins (certutil, bitsadmin, desktopimgdownldr, esentutl, ftp, finger, etc.) executing with URL arguments or download-specific flags. Branch 2 catches PowerShell and scripting engine download cradles making outbound HTTP/S/FTP connections. Branch 3 identifies executable or script files being created in suspicious temporary/user directories by known download utilities. Combining these branches improves coverage across attacker tradecraft from commodity malware stagers to nation-state LOLBin abuse.
Data Sources
Required Tables
False Positives & Tuning
- Software deployment tools (SCCM, Intune, Chocolatey, winget) using certutil or bitsadmin to stage installers into Temp directories
- IT administrators using certutil -urlcache or Invoke-WebRequest for legitimate patch management or inventory scripts
- Developer toolchains (npm, pip, gradle) spawning curl or wget to download build dependencies to temp locations
- Monitoring and backup agents (CrowdStrike, SolarWinds, Veeam) that periodically download update packages using BitsTransfer
- Security scanning tools that use built-in download utilities for OSINT enrichment or threat intel feed ingestion
Other platforms for T1105
Testing Methodology
Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Certutil URL Cache Download
Expected signal: Sysmon Event ID 1: Process Create with Image=certutil.exe, CommandLine containing '-urlcache -split -f http://'. Sysmon Event ID 3: Network Connection from certutil.exe to 127.0.0.1:8080. Sysmon Event ID 11: File Create at %TEMP%\df00tech-test.exe with InitiatingProcessImage=certutil.exe. Security Event ID 4688 if command line auditing is enabled.
- Test 2BitsAdmin File Transfer
Expected signal: Sysmon Event ID 1: Process Create with Image=bitsadmin.exe, CommandLine containing '/transfer' and '/download'. Sysmon Event ID 3: Network Connection from bitsadmin.exe to 127.0.0.1:8080. Microsoft-Windows-Bits-Client/Operational Event ID 3 (job created) and Event ID 59 (transfer complete) if the server responds. Sysmon Event ID 11 for file creation if download succeeds.
- Test 3PowerShell Invoke-WebRequest File Download
Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing 'Invoke-WebRequest' and '-OutFile'. Sysmon Event ID 3: Network Connection from powershell.exe to 127.0.0.1:8080. Sysmon Event ID 11: File Create at %TEMP%\df00tech-iwr.exe. PowerShell ScriptBlock Log Event ID 4104 with full cmdlet and parameters.
- Test 4Certutil Encode-then-Decode Two-Stage Transfer
Expected signal: Two Sysmon Event ID 1 entries: first for certutil.exe -encode, second for certutil.exe -decode. Both events will have CommandLine containing 'certutil.exe' and temp path arguments. The -decode invocation is the targeted indicator. Security Event IDs 4688 for both invocations if command line auditing is enabled.
- Test 5Linux curl Download to /tmp
Expected signal: Auditd syscall records for execve of curl with arguments including '-o /tmp/'. Syslog or auditd file creation record for /tmp/df00tech-test-payload. If auditd rules monitor /tmp writes (WATCH -w /tmp -p w), an auditd WATCH event fires. If endpoint agent (Falcon, Defender for Linux) is present, a process creation event with curl and -o /tmp argument is generated.
References (11)
- https://attack.mitre.org/techniques/T1105/
- https://lolbas-project.github.io/#t1105
- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/certutil
- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/bitsadmin-transfer
- https://cloud.google.com/blog/topics/threat-intelligence/cosmicenergy-ot-malware-russian-response/
- https://www.trellix.com/blogs/research/beyond-file-search-a-novel-method/
- https://www.technologyreview.com/2013/08/21/83143/dropbox-and-similar-services-can-sync-malware/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1105/T1105.md
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_certutil_download.yml
- https://www.mandiant.com/resources/blog/hafnium-china-cyberespionage-exchange-server
- https://www.ptsecurity.com/upload/corporate/ww-en/analytics/Cobalt-Snatch-eng.pdf
Unlock Pro Content
Get the full detection package for T1105 including response playbook, investigation guide, and atomic red team tests.