# T1105 - Ingress Tool Transfer

## Description from ATT&CK

> Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as [ftp](https://attack.mitre.org/software/S0095). Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. [Lateral Tool Transfer](https://attack.mitre.org/techniques/T1570)).
> 
> On Windows, adversaries may use various utilities to download tools, such as `copy`, `finger`, [certutil](https://attack.mitre.org/software/S0160), and [PowerShell](https://attack.mitre.org/techniques/T1059/001) commands such as <code>IEX(New-Object Net.WebClient).downloadString()</code> and <code>Invoke-WebRequest</code>. On Linux and macOS systems, a variety of utilities also exist, such as `curl`, `scp`, `sftp`, `tftp`, `rsync`, `finger`, and `wget`.(Citation: t1105_lolbas)  A number of these tools, such as `wget`, `curl`, and `scp`, also exist on ESXi. After downloading a file, a threat actor may attempt to verify its integrity by checking its hash value (e.g., via `certutil -hashfile`).(Citation: Google Cloud Threat Intelligence COSCMICENERGY 2023)
> 
> Adversaries may also abuse installers and package managers, such as `yum` or `winget`, to download tools to victim hosts. Adversaries have also abused file application features, such as the Windows `search-ms` protocol handler, to deliver malicious files to victims through remote file searches invoked by [User Execution](https://attack.mitre.org/techniques/T1204) (typically after interacting with [Phishing](https://attack.mitre.org/techniques/T1566) lures).(Citation: T1105: Trellix_search-ms)
> 
> Files can also be transferred using various [Web Service](https://attack.mitre.org/techniques/T1102)s as well as native or otherwise present tools on the victim system.(Citation: PTSecurity Cobalt Dec 2016) In some cases, adversaries may be able to leverage services that sync between a web-based and an on-premises client, such as Dropbox or OneDrive, to transfer files onto victim systems. For example, by compromising a cloud account and logging into the service's web portal, an adversary may be able to trigger an automatic syncing process that transfers the file onto the victim's machine.(Citation: Dropbox Malware Sync)

[Source](https://attack.mitre.org/techniques/T1105)

## Atomic Tests

- [Atomic Test #1: rsync remote file copy (push)](#atomic-test-1-rsync-remote-file-copy-push)
- [Atomic Test #2: rsync remote file copy (pull)](#atomic-test-2-rsync-remote-file-copy-pull)
- [Atomic Test #3: scp remote file copy (push)](#atomic-test-3-scp-remote-file-copy-push)
- [Atomic Test #4: scp remote file copy (pull)](#atomic-test-4-scp-remote-file-copy-pull)
- [Atomic Test #5: sftp remote file copy (push)](#atomic-test-5-sftp-remote-file-copy-push)
- [Atomic Test #6: sftp remote file copy (pull)](#atomic-test-6-sftp-remote-file-copy-pull)
- [Atomic Test #7: certutil download (urlcache)](#atomic-test-7-certutil-download-urlcache)
- [Atomic Test #8: certutil download (verifyctl)](#atomic-test-8-certutil-download-verifyctl)
- [Atomic Test #9: Windows - BITSAdmin BITS Download](#atomic-test-9-windows---bitsadmin-bits-download)
- [Atomic Test #10: Windows - PowerShell Download](#atomic-test-10-windows---powershell-download)
- [Atomic Test #11: OSTAP Worming Activity](#atomic-test-11-ostap-worming-activity)
- [Atomic Test #12: svchost writing a file to a UNC path](#atomic-test-12-svchost-writing-a-file-to-a-unc-path)
- [Atomic Test #13: Download a File with Windows Defender MpCmdRun.exe](#atomic-test-13-download-a-file-with-windows-defender-mpcmdrunexe)
- [Atomic Test #14: whois file download](#atomic-test-14-whois-file-download)
- [Atomic Test #15: File Download via PowerShell](#atomic-test-15-file-download-via-powershell)
- [Atomic Test #16: File download with finger.exe on Windows](#atomic-test-16-file-download-with-fingerexe-on-windows)
- [Atomic Test #17: Download a file with IMEWDBLD.exe](#atomic-test-17-download-a-file-with-imewdbldexe)
- [Atomic Test #18: Curl Download File](#atomic-test-18-curl-download-file)
- [Atomic Test #19: Curl Upload File](#atomic-test-19-curl-upload-file)
- [Atomic Test #20: Download a file with Microsoft Connection Manager Auto-Download](#atomic-test-20-download-a-file-with-microsoft-connection-manager-auto-download)
- [Atomic Test #21: MAZE Propagation Script](#atomic-test-21-maze-propagation-script)
- [Atomic Test #22: Printer Migration Command-Line Tool UNC share folder into a zip file](#atomic-test-22-printer-migration-command-line-tool-unc-share-folder-into-a-zip-file)
- [Atomic Test #23: Lolbas replace.exe use to copy file](#atomic-test-23-lolbas-replaceexe-use-to-copy-file)
- [Atomic Test #24: Lolbas replace.exe use to copy UNC file](#atomic-test-24-lolbas-replaceexe-use-to-copy-unc-file)
- [Atomic Test #25: certreq download](#atomic-test-25-certreq-download)
- [Atomic Test #26: Download a file using wscript](#atomic-test-26-download-a-file-using-wscript)
- [Atomic Test #27: Linux Download File and Run](#atomic-test-27-linux-download-file-and-run)
- [Atomic Test #28: Nimgrab - Transfer Files](#atomic-test-28-nimgrab---transfer-files)
- [Atomic Test #29: iwr or Invoke Web-Request download](#atomic-test-29-iwr-or-invoke-web-request-download)
- [Atomic Test #30: Arbitrary file download using the Notepad++ GUP.exe binary](#atomic-test-30-arbitrary-file-download-using-the-notepad-gupexe-binary)
- [Atomic Test #31: File download via nscurl](#atomic-test-31-file-download-via-nscurl)
- [Atomic Test #32: File Download with Sqlcmd.exe](#atomic-test-32-file-download-with-sqlcmdexe)
- [Atomic Test #33: Remote File Copy using PSCP](#atomic-test-33-remote-file-copy-using-pscp)
- [Atomic Test #34: Windows push file using scp.exe](#atomic-test-34-windows-push-file-using-scpexe)
- [Atomic Test #35: Windows pull file using scp.exe](#atomic-test-35-windows-pull-file-using-scpexe)
- [Atomic Test #36: Windows push file using sftp.exe](#atomic-test-36-windows-push-file-using-sftpexe)
- [Atomic Test #37: Windows pull file using sftp.exe](#atomic-test-37-windows-pull-file-using-sftpexe)
- [Atomic Test #38: Download a file with OneDrive Standalone Updater](#atomic-test-38-download-a-file-with-onedrive-standalone-updater)
- [Atomic Test #39: Curl Insecure Connection from a Pod](#atomic-test-39-curl-insecure-connection-from-a-pod)

### Atomic Test #1: rsync remote file copy (push)

Utilize rsync to perform a remote file copy (push)

**Supported Platforms:** Linux, macOS

**auto_generated_guid:** `0fc6e977-cb12-44f6-b263-2824ba917409`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| remote_path | Remote path to receive rsync | path | /tmp/victim-files|
| remote_host | Remote host to copy towar