T1105
Ingress Tool Transfer
Adversaries may transfer tools or files from an external system into a compromised environment to stage operations.
ATT&CK / Command and Control
Defense strategies
- Network monitoring
- Endpoint detection and response
- Application whitelisting
- Download restrictions
Detection methods
- Monitor for large downloads
- Track new executables in temp folders
- Detect certutil/bitsadmin usage
D3FEND mappings
1