Detect Ingress Tool Transfer in Splunk
Adversaries may transfer tools or other files from an external system into a compromised environment. Tools may be pulled via the C2 channel or through alternate protocols using built-in OS utilities (certutil, bitsadmin, PowerShell Invoke-WebRequest, curl, wget, scp). Threat actors including HAFNIUM, Fox Kitten, and Cobalt Group have leveraged this technique to stage second-stage payloads, implants, and post-exploitation toolkits onto victim systems.
MITRE ATT&CK
- Tactic
- Command and Control
- Technique
- T1105 Ingress Tool Transfer
- Canonical reference
- https://attack.mitre.org/techniques/T1105/
SPL Detection Query
index=wineventlog (sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" OR sourcetype="WinEventLog:Security")
(EventCode=1 OR EventCode=4688 OR EventCode=11)
| eval proc=lower(coalesce(Image, NewProcessName, ""))
| eval cmdline=lower(coalesce(CommandLine, ProcessCommandLine, ""))
| eval target_file=lower(coalesce(TargetFilename, ""))
// === Certutil Download ===
| eval certutil_dl=if(
match(proc, "certutil\.exe") AND match(cmdline, "(-urlcache|-decode|-decodehex|-verifyctl)"),
1, 0)
// === BitsAdmin Download ===
| eval bitsadmin_dl=if(
match(proc, "bitsadmin\.exe") AND match(cmdline, "(\/transfer|\/addfile|\/setnotifycmdline)"),
1, 0)
// === PowerShell/Script Download Cradle ===
| eval ps_cradle=if(
match(proc, "(powershell|pwsh|wscript|cscript)\.exe") AND
match(cmdline, "(invoke-webrequest|iwr\s|net\.webclient|downloadfile|downloaddata|downloadstring|start-bitstransfer|webclient|httpclient|webrequest\.create)") AND
match(cmdline, "https?://|ftp://"),
1, 0)
// === Other LOLBin Downloads ===
| eval lolbin_dl=if(
match(proc, "(desktopimgdownldr|esentutl|finger|ftp|expand|extrac32|replace|ieexec|mshta)\.exe") AND
match(cmdline, "https?://|ftp://"),
1, 0)
// === Curl/Wget Native ===
| eval curl_wget=if(
match(proc, "(curl|wget)\.exe") AND match(cmdline, "https?://|ftp://"),
1, 0)
// === Executable Dropped in Temp by Download Utility (Sysmon Event 11) ===
| eval exec_in_temp=if(
EventCode=11 AND
match(target_file, "(\\.exe|\\.dll|\\.ps1|\\.vbs|\\.bat|\\.hta|\\.scr|\\.bin|\\.msi)$") AND
match(target_file, "(\\temp\\|\\appdata\\|\\programdata\\|\\users\\public\\)") AND
match(proc, "(certutil|bitsadmin|powershell|pwsh|curl|wget|mshta|wscript|cscript)\.exe"),
1, 0)
| eval SuspicionScore = certutil_dl + bitsadmin_dl + ps_cradle + lolbin_dl + curl_wget + exec_in_temp
| where SuspicionScore > 0
| eval DetectionReasons=mvappend(
if(certutil_dl=1, "certutil_download", null()),
if(bitsadmin_dl=1, "bitsadmin_download", null()),
if(ps_cradle=1, "ps_download_cradle", null()),
if(lolbin_dl=1, "lolbin_download", null()),
if(curl_wget=1, "curl_wget_download", null()),
if(exec_in_temp=1, "exec_dropped_in_temp", null())
)
| eval DetectionReasons=mvjoin(DetectionReasons, ", ")
| table _time, host, User, proc, cmdline, target_file, DetectionReasons, SuspicionScore
| sort - _timeDetects ingress tool transfer using Sysmon Event ID 1 (Process Create), Security Event ID 4688 (Process Creation), and Sysmon Event ID 11 (File Create). Evaluates six distinct download indicators: certutil URL cache/decode operations, bitsadmin file transfer arguments, PowerShell/script engine download cradles with HTTP/FTP URLs, other LOLBin utilities with remote URL arguments, native curl/wget execution, and executable files written to temp/appdata paths by known download utilities. Assigns a cumulative SuspicionScore and a human-readable DetectionReasons field to aid analyst triage.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Software deployment tools (SCCM, Intune, Chocolatey, winget) using certutil or bitsadmin to stage installers into Temp directories
- IT administrators using certutil -urlcache or Invoke-WebRequest for legitimate patch management or inventory scripts
- Developer toolchains (npm, pip, gradle) spawning curl or wget to download build dependencies to temp locations
- Monitoring and backup agents (CrowdStrike, SolarWinds, Veeam) that periodically download update packages using BitsTransfer
- Security scanning tools that use built-in download utilities for OSINT enrichment or threat intel feed ingestion
Other platforms for T1105
Testing Methodology
Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Certutil URL Cache Download
Expected signal: Sysmon Event ID 1: Process Create with Image=certutil.exe, CommandLine containing '-urlcache -split -f http://'. Sysmon Event ID 3: Network Connection from certutil.exe to 127.0.0.1:8080. Sysmon Event ID 11: File Create at %TEMP%\df00tech-test.exe with InitiatingProcessImage=certutil.exe. Security Event ID 4688 if command line auditing is enabled.
- Test 2BitsAdmin File Transfer
Expected signal: Sysmon Event ID 1: Process Create with Image=bitsadmin.exe, CommandLine containing '/transfer' and '/download'. Sysmon Event ID 3: Network Connection from bitsadmin.exe to 127.0.0.1:8080. Microsoft-Windows-Bits-Client/Operational Event ID 3 (job created) and Event ID 59 (transfer complete) if the server responds. Sysmon Event ID 11 for file creation if download succeeds.
- Test 3PowerShell Invoke-WebRequest File Download
Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing 'Invoke-WebRequest' and '-OutFile'. Sysmon Event ID 3: Network Connection from powershell.exe to 127.0.0.1:8080. Sysmon Event ID 11: File Create at %TEMP%\df00tech-iwr.exe. PowerShell ScriptBlock Log Event ID 4104 with full cmdlet and parameters.
- Test 4Certutil Encode-then-Decode Two-Stage Transfer
Expected signal: Two Sysmon Event ID 1 entries: first for certutil.exe -encode, second for certutil.exe -decode. Both events will have CommandLine containing 'certutil.exe' and temp path arguments. The -decode invocation is the targeted indicator. Security Event IDs 4688 for both invocations if command line auditing is enabled.
- Test 5Linux curl Download to /tmp
Expected signal: Auditd syscall records for execve of curl with arguments including '-o /tmp/'. Syslog or auditd file creation record for /tmp/df00tech-test-payload. If auditd rules monitor /tmp writes (WATCH -w /tmp -p w), an auditd WATCH event fires. If endpoint agent (Falcon, Defender for Linux) is present, a process creation event with curl and -o /tmp argument is generated.
References (11)
- https://attack.mitre.org/techniques/T1105/
- https://lolbas-project.github.io/#t1105
- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/certutil
- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/bitsadmin-transfer
- https://cloud.google.com/blog/topics/threat-intelligence/cosmicenergy-ot-malware-russian-response/
- https://www.trellix.com/blogs/research/beyond-file-search-a-novel-method/
- https://www.technologyreview.com/2013/08/21/83143/dropbox-and-similar-services-can-sync-malware/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1105/T1105.md
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_certutil_download.yml
- https://www.mandiant.com/resources/blog/hafnium-china-cyberespionage-exchange-server
- https://www.ptsecurity.com/upload/corporate/ww-en/analytics/Cobalt-Snatch-eng.pdf
Unlock Pro Content
Get the full detection package for T1105 including response playbook, investigation guide, and atomic red team tests.