sarahwei/cyber_MITRE_CTI_dataset_v15 huggingface dataset:
Aria-body has the ability to download additional payloads from C2.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Astaroth uses certutil and BITSAdmin to download additional malware.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
AsyncRAT has the ability to download files over SFTP.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Attor can download additional plugins, updates and other files.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
AuditCred can download files and additional malware.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Avenger has the ability to download files from C2 to a compromised host.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Azorult can download and execute additional files. Azorult has also downloaded a ransomware payload called Hermes.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
BADFLICK has download files from its C2 server.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
BADHATCH has the ability to load a second stage malicious DLL file onto a compromised machine.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
BADNEWS is capable of downloading additional files through C2 channels, including a new version of itself.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
BBK has the ability to download files from C2 to the infected host.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
BISCUIT has a command to download a file from the C2 server.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
BITSAdmin can be used to create BITS Jobs to upload and/or download files.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
BLINDINGCAN has downloaded files to a victim machine.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
BLUELIGHT can download additional files onto the host.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
BONDUPDATER can download or upload files from its C2 server.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
BUSHWALK can write malicious payloads sent through a web request’s command parameter.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
BabyShark has downloaded additional files from the C2.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
BackConfig can download and execute additional payloads on a compromised host.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Backdoor.Oldrea can download additional modules from C2.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
BadPatch can download and execute or update malware.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Bandook can download files to the system.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Bankshot uploads files and secondary payloads to the victim's machine.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Bazar can download and deploy additional payloads, including ransomware and post-exploitation frameworks such as Cobalt Strike.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
BendyBear is designed to download an implant from a C2 server.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Bisonal has the capability to download files to execute on the victim’s machine.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
BlackMould has the ability to download files to the victim's machine.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Bonadan can download additional modules from the C2 server.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
BoomBox has the ability to download next stage malware components to a compromised system.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
BoxCaon can download files.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Briba downloads files onto infected hosts.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Brute Ratel C4 can download files to compromised hosts.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Bumblebee can download and execute additional payloads including through the use of a `Dex` command.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Bundlore can download and execute new versions of itself.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
CARROTBALL has the ability to download and install a remote payload.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
CARROTBAT has the ability to download and execute a remote file via certutil.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
CHOPSTICK is capable of performing remote file transmission.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
CORESHELL downloads another dropper from its C2 server.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
CSPY Downloader can download additional tools to a compromised host.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Calisto has the capability to upload and download files to the victim's machine.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
CallMe has the capability to download a file to the victim from the C2 server.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Cannon can download a payload for execution.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Carberp can download and execute new plugins from the C2 server.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Cardinal RAT can download and execute additional payloads.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Caterpillar WebShell has a module to download and upload files to the system.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
ChChes is capable of downloading files, including additional modules.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Chaes can download additional files onto an infected machine.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
CharmPower has the ability to download additional modules to a compromised host.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
China Chopper's server component can download remote files.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Chrommme can download its code from C2.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
CloudDuke downloads and executes additional malware from either a Web address or a Microsoft OneDrive account.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Cobalt Strike can deliver additional payloads to victim machines.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
CoinTicker executes a Python script to download its second stage.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Conficker downloads an HTTP server to the infected machine.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
CookieMiner can download additional scripts from a web server.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
CostaBricks has been used to load SombRAT onto a compromised host.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
CreepyDrive can download files to the compromised host.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Crimson contains a command to retrieve files from its C2 server.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Cryptoistic has the ability to send and receive files.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Cuba can download files from its C2 server.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Cyclops Blink has the ability to download files to target systems.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
DDKONG downloads and uploads files on the victim’s machine.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
DEATHRANSOM can download files to a compromised host.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
DOGCALL can download and execute additional payloads.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
DRATzarus can deploy additional tools onto an infected machine.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Dacls can download its payload from a C2 server.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
DanBot can download additional files to a targeted system.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
DarkComet can load any files onto the infected machine to execute.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
DarkGate retrieves cryptocurrency mining payloads and commands in encrypted traffic from its command and control server. DarkGate uses Windows Batch scripts executing the `curl` command to retrieve follow-on payloads.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
DarkTortilla can download additional packages for keylogging, cryptocurrency mining, and other capabilities; it can also retrieve malicious payloads such as Agent Tesla, AsyncRat, NanoCore, RedLine, Cobalt Strike, and Metasploit.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Daserf can download remote files.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Denis deploys additional backdoors and hacking tools to the system.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Diavol can receive configuration updates and additional payloads including wscpy.exe from C2.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Dipsind can download remote files.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Disco can download files to targeted systems via SMB.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
DnsSystem can download files to compromised systems after receiving a command with the string `downloaddd`.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Doki has downloaded scripts from C2.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Donut can download and execute previously staged shellcode payloads.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
After downloading its main config file, Downdelph downloads multiple payloads from C2 servers.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
DropBook can download and execute additional files.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Drovorub can download files to a compromised host.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Dtrack’s can download and upload a file to the victim’s computer.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Dyre has a command to download and executes additional files.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
EVILNUM can download and upload files to the victim's computer.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Ecipekac can download additional payloads to a compromised host.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Egregor has the ability to download files from its C2 server.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Elise can download additional files from the C2 server for execution.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Emissary has the capability to download files from the C2 server.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Empire can upload and download to and from a victim machine.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
EvilBunny has downloaded additional Lua scripts from the C2.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Exaramel for Linux has a command to download a file from  and to a remote C2 server.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Explosive has a function to download a file to the infected system.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
FELIXROOT downloads and uploads files to and from the victim’s machine.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
FYAnti can download additional payloads to a compromised host.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Felismus can download files from remote servers.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Flagpro can download additional malware from the C2 server.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
FlawedAmmyy can transfer files from C2.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
FoggyWeb can receive additional malicious components from an actor controlled C2 server and execute them on a compromised AD FS server.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
FunnyDream can download additional files onto a compromised host.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Gazer can execute a task to download a file.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Gelsemium can download additional plug-ins to a compromised host.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Gold Dragon can download additional components from the C2 server.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
GoldMax can download and execute additional files.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
GoldenSpy constantly attempts to download and execute files from the remote C2, including GoldenSpy itself if not found on the system.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Grandoreiro can download its second stage from a hardcoded URL within the loader's code.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
GreyEnergy can download additional modules and payloads.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
GrimAgent has the ability to download and execute additional payloads.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
GuLoader can download further malware for execution on the victim's machine.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
H1N1 contains a command to download and execute a file from a remotely hosted URL using WinINet HTTP requests.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
can download and execute a second-stage payload.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
HOPLIGHT has the ability to connect to a remote host in order to upload and download files.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
HTTPBrowser is capable of writing a file to the compromised system from the C2 server.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Hancitor has the ability to download additional files from C2.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Helminth can download additional files.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Hi-Zor has the ability to upload and download files from its C2 server.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
HiddenWasp downloads a tar compressed archive from a download server to the system.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Hikit has the ability to download files to a compromised host.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Hildegard has downloaded additional scripts that build and run Monero cryptocurrency miners.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
HotCroissant has the ability to upload a file from the command and control (C2) server to the victim machine.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Hydraq creates a backdoor through which remote attackers can download files and additional malware components.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
HyperBro has the ability to download additional files.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
IcedID has the ability to download additional modules and a configuration file from C2.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Industroyer downloads a shellcode payload from a remote C2 server and loads it into memory.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
InvisiMole can upload files to the victim's machine for operations.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Ixeshe can download and execute additional files.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
JHUHUGIT can retrieve an additional payload from its C2 server. JHUHUGIT has a command to download files to the victim’s machine.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
JPIN can download files and upgrade itself.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
JSS Loader has the ability to download malicious executables to a compromised host.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Javali can download payloads from remote C2 servers.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
KARAE can upload and download files, including second-stage malware.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
KEYMARBLE can upload files to the victim’s machine and can download additional payloads.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
KGH_SPY has the ability to download and execute code from remote servers.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
KOCTOPUS has executed a PowerShell command to download a file to the system.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
KONNI can download files and execute them on the victim’s machine.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Kasidet has the ability to download and execute additional files.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Kazuar downloads additional plug-ins to load on the victim’s machine, including the ability to upgrade and replace its own binary.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Kerrdown can download specific payloads to a compromised host based on OS architecture.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Kessel can download additional modules from the C2 server.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Kevin can download files to the compromised host.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
KeyBoy has a download and upload functionality.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Kinsing has downloaded additional lateral movement scripts from C2.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Kivars has the ability to download and execute files.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Koadic can download additional files and tools.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Kwampirs downloads additional files from C2 servers.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
LOWBALL uses the Dropbox API to request two files, one of which is the same file as the one dropped by the malicious email attachment. This is most likely meant to be a mechanism to update the compromised host with a new version of the LOWBALL malware.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
LightNeuron has the ability to download and execute additional files.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Linfo creates a backdoor through which remote attackers can download files onto compromised hosts.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
LiteDuke has the ability to download files.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
LitePower has the ability to download payloads containing system commands to a compromised host.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Lizar can download additional plugins, files, and tools.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Lokibot downloaded several staged items onto the victim's machine.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
LoudMiner used SCP to update the miner from the C2.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Lucifer can download and execute a replica of itself using certutil.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
MCMD can upload additional files to a compromised host.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
MacMa has downloaded additional files, including an exploit for used privilege escalation.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Machete can download additional files for execution on the victim’s machine.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Mafalda can download additional files onto the compromised host.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
MarkiRAT can download additional files and tools from its C2 server, including through the use of BITSAdmin.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
MechaFlounder has the ability to upload and download files to and from a compromised host.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Melcoz has the ability to download additional files to a compromised host.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Metamorfo has used MSI files to download additional files to execute.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Meteor has the ability to download additional files for execution on the victim's machine.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Micropsia can download and execute an executable from the C2 server.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Milan has received files from C2 and stored them in log folders beginning with the character sequence `a9850d2f`.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
MiniDuke can download additional encrypted backdoors onto the victim via GIF files.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Mis-Type has downloaded additional malware and files onto a compromised host.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Misdat is capable of downloading files from the C2.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Mivast has the capability to download and execute .exe files.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
MobileOrder has a command to download a file from the C2 server to the victim mobile device's SD card.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
MoleNet can download additional payloads from the C2.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Mongall can download files to targeted systems.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
More_eggs can download and launch additional payloads.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Mosquito can upload and download files to the victim.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
NDiskMonitor can download and execute a file from given URL.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
NETWIRE can downloaded payloads from C2 to the compromised host.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
NOKKI has downloaded a remote module for execution.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
NanHaiShu can download additional files from URLs.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
NanoCore has the capability to download and activate additional modules for execution.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
NavRAT can download files remotely.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Nebulae can download files from C2.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Neoichor can download additional files onto a compromised host.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Nerex creates a backdoor through which remote attackers can download files onto a compromised host.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Operators deploying Netwalker have used psexec and certutil to retrieve the Netwalker payload.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Nidiran can download and execute files.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
NightClub can load multiple additional plugins on an infected host.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
OSX/Shlayer can download payloads, and extract bytes from files. OSX/Shlayer uses the `curl -fsL "$url" >$tmp_path` command to download malicious payloads into a temporary directory.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
OSX_OCEANLOTUS.D has a command to download and execute a file on the victim’s machine.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Octopus can download additional files and tools onto the victim’s machine.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Okrum has built-in commands for uploading, downloading, and executing files to the system.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
OopsIE can download files from its C2 server to the victim's machine.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Orz can download files onto the victim.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
OutSteel can download files from its C2 server.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
P.A.S. Webshell can upload and download files to and from compromised hosts.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
P8RAT can download additional payloads to a target system.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
PLAINTEE has downloaded and executed additional plugins.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
PLEAD has the ability to upload and download files to and from an infected host.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
POSHSPY downloads and executes additional PowerShell code and Windows binaries.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
POWERSOURCE has been observed being used to download TEXTMATE and the Cobalt Strike Beacon payload onto victims.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
POWERSTATS can retrieve and execute additional PowerShell payloads from the C2 server.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
POWRUNER can download or upload files from its C2 server.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
CostaBricks can download additional payloads onto a compromised host.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
PUNCHBUGGY can download additional files and payloads to compromised hosts.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Pandora can load additional drivers and files onto a victim machine.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Pasam creates a backdoor through which remote attackers can upload files.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Penquin can execute the command code `do_download` to retrieve remote files from C2.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Peppy can download and execute remote files.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
PipeMon can install additional modules via C2 commands.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Pisloader has a command to upload a file to the victim machine.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
PlugX has a module to download and execute files on the compromised machine.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
PoetRAT has the ability to copy files and download/upload files into C2 channels using FTP and HTTPS.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
PoisonIvy creates a backdoor through which remote attackers can upload files.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
PolyglotDuke can retrieve payloads from the C2 server.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Pony can download additional files onto the infected system.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
PowerDuke has a command to download a file.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
PowerLess can download additional payloads to a compromised host.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
PowerPunch can download payloads from adversary infrastructure.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Psylo has a command to download a file to the system from its C2 server.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Pteranodon can download and execute additional files.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Pupy can upload and download to/from a victim machine.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
QakBot has the ability to download additional components and malware.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
QuasarRAT can download files to the victim’s machine and execute them.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
QuietSieve can download and execute payloads on a target host.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
RARSTONE downloads its backdoor component from a C2 server and loads it directly into memory.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
RATANKBA uploads and downloads information.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
RCSession has the ability to drop additional files to an infected machine.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
RDAT can download files via DNS.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
REvil can download a copy of itself from an attacker controlled IP address to the victim machine.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
RGDoor uploads and downloads files to and from the victim’s machine.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
ROKRAT can retrieve additional malicious payloads from its C2 server.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
RTM can download additional files.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
RainyDay can download files to a compromised host.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
RedLeaves is capable of downloading a file from a specified URL.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
RegDuke can download files from C2.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Remcos can upload and download files to and from the victim’s machine.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
RemoteCMD copies a file over to the remote system before execution.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
RemoteUtilities can upload and download files to and from a target machine.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Remsec contains a network loader to receive executable modules from remote attackers and run them on the local victim. It can also upload and download files over HTTP and HTTPS.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Revenge RAT has the ability to upload and download files.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
RogueRobin can save a new file to the system from the C2 server.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
S-Type can download additional files onto a compromised host.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
SDBbot has the ability to download a DLL from C2 to a compromised host.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
SEASHARPEE can download remote files onto victims.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
SHARPSTATS has the ability to upload and download files.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
SHUTTERSPEED can download and execute an arbitary executable.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
SILENTTRINITY can load additional files and tools, including Mimikatz.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
RAPIDPULSE can transfer files to and from compromised hosts.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
SLOTHFULMEDIA has downloaded files onto a victim machine.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
SLOWDRIFT downloads additional payloads.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
SMOKEDHAM has used Powershell to download UltraVNC and ngrok from third-party file sharing sites.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
SQLRat can make a direct SQL connection to a Microsoft database controlled by the attackers, retrieve an item from the bindata table, then write and execute the file on disk.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
STEADYPULSE can add lines to a Perl script on a targeted server to import additional Perl modules.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
SUNBURST delivered different payloads, including TEARDROP in at least one instance.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
SVCReady has the ability to download additional tools such as the RedLine Stealer to an infected host.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Saint Bot can download additional files onto a compromised host.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Sakula has the capability to download files.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Samurai has been used to deploy other malware including Ninja.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Sardonic has the ability to upload additional malicious files to a compromised machine.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
SeaDuke is capable of uploading and downloading files.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Seasalt has a command to download additional files.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
ServHelper may download additional files to execute.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Seth-Locker has the ability to download and execute files on a compromised host.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
ShadowPad has downloaded code from a C2 server.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Shamoon can download an executable to run on the victim.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Shark  can download additional files from its C2 via HTTP or DNS.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
SharpDisco has been used to download a Python interpreter to `C:\Users\Public\WinTN\WinTN.exe` as well as other plugins from external sources.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
SharpStage has the ability to download and execute additional payloads via a DropBox API.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
ShimRat can download additional files.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
ShimRatReporter had the ability to download additional payloads.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Sibot can download and execute a payload onto a compromised system.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
SideTwist has the ability to download additional files.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Skidmap has the ability to download files on an infected host.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Sliver can upload files from the C2 server to the victim machine using the `upload` command.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Small Sieve has the ability to download files.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Smoke Loader downloads a new version of itself once it has installed. It also downloads additional plugins.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Snip3 can download additional payloads to compromised systems.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
SocGholish can download additional malware to infected hosts.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
SodaMaster has the ability to download additional payloads from C2 to the targeted system.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
SombRAT has the ability to download and execute additional payloads.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
SoreFang can download additional payloads from C2.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
SpeakUp downloads and executes additional files from a remote server.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
SpicyOmelette can download malicious files from threat actor controlled AWS URL's.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Squirrelwaffle has downloaded and executed additional encoded payloads.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
StoneDrill has downloaded and dropped temporary files containing scripts; it additionally has a function to upload files from the victims machine.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
StrifeWater can download updates and auxiliary modules.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
StrongPity can download files to specified targets.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
SysUpdate has the ability to download files to a compromised host.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
TAINTEDSCRIBE can download additional modules from its C2 server.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
TDTESS has a command to download and execute an additional file.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
TSCookie has the ability to upload and download files to and from the infected host.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
TURNEDUP is capable of downloading additional files.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
TYPEFRAME can upload and download files to the victim’s machine.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Taidoor has downloaded additional files onto a compromised host.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
ThiefQuest can download and execute payloads in-memory or from disk.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
ThreatNeedle can download additional tools to enable lateral movement.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
TinyTurla has the ability to act as a second-stage dropper used to infect the system with additional malware.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Tomiris can download files and execute them on a victim's system.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
TrickBot downloads several additional files and saves them to the victim's machine.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Trojan.Karagany can upload, download, and execute files on the victim.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Turian can download additional files and tools from its C2.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
UBoatRAT can upload and download files to the victim’s machine.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
UPPERCUT can download and upload files to and from the victim’s machine.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Unknown Logger is capable of downloading remote files.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Uroburos can use a `Put` command to write files to an infected machine.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Ursnif has dropped payload and configuration files to disk. Ursnif has also been used to download and execute additional payloads.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
VBShower has the ability to download VBS files to the target computer.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
VERMIN can download and upload files to the victim's machine.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Valak has downloaded a variety of modules and payloads to the compromised host, including IcedID and NetSupport Manager RAT-based malware.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
VaporRage has the ability to download malicious shellcode to compromised systems.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Vasport can download files.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Volgmer can download remote files and additional payloads to the victim's machine.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
WEBC2 can download and execute a file.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
WIREFIRE has the ability to download files to compromised devices.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
WarzoneRAT can download and execute additional files.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Waterbear can receive and load executables from remote C2 servers.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
WellMail can receive data and executable scripts from C2.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
WellMess can write files to a compromised host.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
WhisperGate can download additional stages of malware from a Discord CDN channel.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Wiarp creates a backdoor through which remote attackers can download files.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Winnti for Linux has the ability to deploy modules directly from command and control (C2) servers, possibly for remote command execution, file exfiltration, and socks5 proxying on the infected host.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
The Winnti for Windows dropper can place malicious payloads on targeted systems.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Woody RAT can download files from its C2 server, including the .NET DLLs, `WoodySharpExecutor` and `WoodyPowerSession`.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
XCSSET downloads browser specific AppleScript modules using a constructed URL with the `curl` command, `https://" & domain & "/agent/scripts/" & moduleName & ".applescript`.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Xbash can download additional malicious files from its C2 server.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
YAHOYAH uses HTTP GET requests to download other files that are executed in memory.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
ZIPLINE can download files to be saved on the compromised system.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
ZLib has the ability to download files.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Zebrocy obtains additional code to execute on the victim's machine, including the downloading of a secondary payload.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
ZeroT can download additional payloads onto the victim.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Zeus Panda can download additional malware plug-in modules and execute them on the victim’s machine.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
Zox can download files to a compromised machine.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
ZxShell has a command to transfer files from a remote host.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control
ZxxZ can download and execute additional files.
Technique: T1105 Ingress Tool Transfer, Tactic: TA0011 Command and Control