Detect Ingress Tool Transfer in Sumo Logic CSE
Adversaries may transfer tools or other files from an external system into a compromised environment. Tools may be pulled via the C2 channel or through alternate protocols using built-in OS utilities (certutil, bitsadmin, PowerShell Invoke-WebRequest, curl, wget, scp). Threat actors including HAFNIUM, Fox Kitten, and Cobalt Group have leveraged this technique to stage second-stage payloads, implants, and post-exploitation toolkits onto victim systems.
MITRE ATT&CK
- Tactic
- Command and Control
- Technique
- T1105 Ingress Tool Transfer
- Canonical reference
- https://attack.mitre.org/techniques/T1105/
Sumo Detection Query
(_sourceCategory=*Windows* OR _sourceCategory=*Sysmon* OR _sourceCategory=*wineventlog*)
| parse field=_raw "Image: *\r\n" as Image nodrop
| parse field=_raw "CommandLine: *\r\n" as CommandLine nodrop
| parse field=_raw "NewProcessName: *\r\n" as NewProcessName nodrop
| parse field=_raw "TargetFilename: *\r\n" as TargetFilename nodrop
| parse field=_raw "EventID: *\r\n" as ParsedEventID nodrop
| parse field=_raw "EventCode: *\r\n" as ParsedEventCode nodrop
| eval EventID = if (!isNull(ParsedEventID), ParsedEventID, if (!isNull(ParsedEventCode), ParsedEventCode, ""))
| eval ProcessName = toLowerCase(if (!isNull(Image), Image, if (!isNull(NewProcessName), NewProcessName, "")))
| eval CmdLine = toLowerCase(if (!isNull(CommandLine), CommandLine, ""))
| eval TargetFile = toLowerCase(if (!isNull(TargetFilename), Targetfilename, ""))
| where
(
(ProcessName contains "certutil.exe" and (CmdLine contains "-urlcache" or CmdLine contains "-decode" or CmdLine contains "-decodehex" or CmdLine contains "-verifyctl"))
or
(ProcessName contains "bitsadmin.exe" and (CmdLine contains "/transfer" or CmdLine contains "/addfile" or CmdLine contains "/setnotifycmdline"))
or
(
(ProcessName contains "powershell.exe" or ProcessName contains "pwsh.exe" or ProcessName contains "wscript.exe" or ProcessName contains "cscript.exe")
and (CmdLine contains "invoke-webrequest" or CmdLine contains "net.webclient" or CmdLine contains "downloadfile" or CmdLine contains "downloaddata" or CmdLine contains "start-bitstransfer" or CmdLine contains "webclient" or CmdLine contains "httpclient" or CmdLine contains "webrequest.create")
and (CmdLine contains "http://" or CmdLine contains "https://")
)
or
(
(ProcessName contains "curl.exe" or ProcessName contains "wget.exe")
and (CmdLine contains "http://" or CmdLine contains "https://")
)
or
(
(ProcessName contains "desktopimgdownldr.exe" or ProcessName contains "esentutl.exe" or ProcessName contains "expand.exe" or ProcessName contains "extrac32.exe" or ProcessName contains "finger.exe" or ProcessName contains "ftp.exe" or ProcessName contains "ieexec.exe" or ProcessName contains "mshta.exe" or ProcessName contains "xcopy.exe")
and (CmdLine contains "http://" or CmdLine contains "https://" or CmdLine contains "ftp://")
)
or
(
(EventID = "11" or EventID = "4663")
and (TargetFile contains "\\temp\\" or TargetFile contains "\\appdata\\" or TargetFile contains "\\programdata\\" or TargetFile contains "\\users\\public\\" or TargetFile contains "\\windows\\temp\\")
and (TargetFile matches "*.exe" or TargetFile matches "*.dll" or TargetFile matches "*.ps1" or TargetFile matches "*.vbs" or TargetFile matches "*.bat" or TargetFile matches "*.hta" or TargetFile matches "*.scr" or TargetFile matches "*.msi")
and (ProcessName contains "certutil.exe" or ProcessName contains "bitsadmin.exe" or ProcessName contains "powershell.exe" or ProcessName contains "pwsh.exe" or ProcessName contains "curl.exe" or ProcessName contains "wget.exe" or ProcessName contains "mshta.exe" or ProcessName contains "wscript.exe" or ProcessName contains "cscript.exe")
)
)
| eval DetectionType = if (ProcessName contains "certutil.exe" and (CmdLine contains "-urlcache" or CmdLine contains "-decode"), "certutil_download",
if (ProcessName contains "bitsadmin.exe" and (CmdLine contains "/transfer" or CmdLine contains "/addfile"), "bitsadmin_download",
if ((ProcessName contains "powershell.exe" or ProcessName contains "pwsh.exe") and (CmdLine contains "invoke-webrequest" or CmdLine contains "downloadfile" or CmdLine contains "net.webclient" or CmdLine contains "start-bitstransfer"), "ps_download_cradle",
if ((ProcessName contains "curl.exe" or ProcessName contains "wget.exe"), "curl_wget_download",
if ((EventID = "11"), "exec_dropped_temp", "lolbin_download")))))
| fields _messageTime, _sourceHost, EventID, ProcessName, CmdLine, TargetFile, DetectionType
| sort by _messageTime descSumo Logic detection for T1105 Ingress Tool Transfer. Parses Windows event log and Sysmon messages to extract process image, command line, and target file fields. Detects certutil and bitsadmin download flags, PowerShell/script interpreter download cradles with HTTP URLs, curl/wget invocations, and executable files dropped into user-writable temporary paths by known download utilities. Compatible with Windows Event 4688, Sysmon Event 1, and Sysmon Event 11 log sources.
Data Sources
Required Tables
False Positives & Tuning
- Software distribution tools such as SCCM client or WinGet invoking certutil for package verification or bitsadmin for background downloads from Microsoft Update servers or internal WSUS/MECM distribution points
- Security scanning or vulnerability assessment tools that use PowerShell WebClient methods to check for agent updates or download scanner signatures — particularly common for Tenable, Qualys, and Rapid7 agents at startup
- DevOps tooling on developer machines where PowerShell profile scripts or IDE extensions use Invoke-WebRequest to fetch project templates, nuget packages, or SDK components from public package registries
Other platforms for T1105
Testing Methodology
Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Certutil URL Cache Download
Expected signal: Sysmon Event ID 1: Process Create with Image=certutil.exe, CommandLine containing '-urlcache -split -f http://'. Sysmon Event ID 3: Network Connection from certutil.exe to 127.0.0.1:8080. Sysmon Event ID 11: File Create at %TEMP%\df00tech-test.exe with InitiatingProcessImage=certutil.exe. Security Event ID 4688 if command line auditing is enabled.
- Test 2BitsAdmin File Transfer
Expected signal: Sysmon Event ID 1: Process Create with Image=bitsadmin.exe, CommandLine containing '/transfer' and '/download'. Sysmon Event ID 3: Network Connection from bitsadmin.exe to 127.0.0.1:8080. Microsoft-Windows-Bits-Client/Operational Event ID 3 (job created) and Event ID 59 (transfer complete) if the server responds. Sysmon Event ID 11 for file creation if download succeeds.
- Test 3PowerShell Invoke-WebRequest File Download
Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing 'Invoke-WebRequest' and '-OutFile'. Sysmon Event ID 3: Network Connection from powershell.exe to 127.0.0.1:8080. Sysmon Event ID 11: File Create at %TEMP%\df00tech-iwr.exe. PowerShell ScriptBlock Log Event ID 4104 with full cmdlet and parameters.
- Test 4Certutil Encode-then-Decode Two-Stage Transfer
Expected signal: Two Sysmon Event ID 1 entries: first for certutil.exe -encode, second for certutil.exe -decode. Both events will have CommandLine containing 'certutil.exe' and temp path arguments. The -decode invocation is the targeted indicator. Security Event IDs 4688 for both invocations if command line auditing is enabled.
- Test 5Linux curl Download to /tmp
Expected signal: Auditd syscall records for execve of curl with arguments including '-o /tmp/'. Syslog or auditd file creation record for /tmp/df00tech-test-payload. If auditd rules monitor /tmp writes (WATCH -w /tmp -p w), an auditd WATCH event fires. If endpoint agent (Falcon, Defender for Linux) is present, a process creation event with curl and -o /tmp argument is generated.
References (11)
- https://attack.mitre.org/techniques/T1105/
- https://lolbas-project.github.io/#t1105
- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/certutil
- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/bitsadmin-transfer
- https://cloud.google.com/blog/topics/threat-intelligence/cosmicenergy-ot-malware-russian-response/
- https://www.trellix.com/blogs/research/beyond-file-search-a-novel-method/
- https://www.technologyreview.com/2013/08/21/83143/dropbox-and-similar-services-can-sync-malware/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1105/T1105.md
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_certutil_download.yml
- https://www.mandiant.com/resources/blog/hafnium-china-cyberespionage-exchange-server
- https://www.ptsecurity.com/upload/corporate/ww-en/analytics/Cobalt-Snatch-eng.pdf
Unlock Pro Content
Get the full detection package for T1105 including response playbook, investigation guide, and atomic red team tests.