T1105Ingress Tool Transfer
T1105 — Ingress Tool Transfer is a MITRE ATT&CK technique in the Command and Control tactic. Clankerusecase tracks 171 detection use cases covering it and 87 threat-intel articles citing it.
Command and Control
171Use cases
87Articles
0Sub-techniques
1Tactic
Use cases covering this technique (171)
[WEEKLY] Brand-Impersonation Domain Fetch Followed by User-Context Loader Within 10 Minutes [WEEKLY] Cross-Platform ClickFix Paste-to-Pipe Loader (UI-Parent Shell with Decode-and-Execute Payload) [WEEKLY] Developer/AI tooling runtime spawns shell or egress LOLBin (unauth RCE post-expl) [WEEKLY] Developer package install spawning script-host with non-registry C2 within 5 minutes [WEEKLY] Internet-facing server process spawns interpreter then beacons to first-seen external host within 5 minutes [WEEKLY] Internet-Facing Service Process Spawning Unix Shell or Ingress-Tool LOLBin (Edge Zero-Day Post-Exploit) [WEEKLY] Low-Code / AI Workflow Runtime Sandbox-Escape — Server Process Spawns Shell + Public Egress [WEEKLY] Package Manager Install Spawning Outbound Egress to Non-Registry Infrastructure Within 5 Minutes [WEEKLY] Package manager lifecycle hook spawns network-fetching shell or runtime [WEEKLY] Package manager spawns network-fetching child to public code-hosting within minutes of install [WEEKLY] Server / AI-agent process spawns shell or LOLBIN with public egress — post-RCE behavioural chain [WEEKLY] Web App Interpreter (Node/Python/Java/PHP) Spawns Shell or Net-Download LOLBin on Internet-Facing Host Microsoft Intune Device Health Scripts Microsoft Intune Mobile Apps BITSAdmin Download File Cisco Isovalent - Curl Execution With Insecure Flags Cisco NVM - Suspicious File Download via Headless Browser Cisco NVM - Webserver Download From File Sharing Website Curl Execution with Percent Encoded URL Detect Certify Command Line Arguments Download Files Using Telegram File Download or Read to Pipe Execution Linux Curl Upload File Linux Ingress Tool Transfer Hunting Linux Ingress Tool Transfer with Curl Living Off The Land Detection Log4Shell CVE-2021-44228 Exploitation LOLBAS With Network Traffic PowerShell Script Block With URL Chain PowerShell WebRequest Using Memory Stream Suspicious Curl Network Connection Windows Cabinet File Extraction Via Expand Windows Curl Download to Suspicious Path Windows Curl Upload to Remote Destination Windows DLL Module Loaded in Temp Dir Windows DNS Query Request To TinyUrl Windows File Download Via CertUtil Windows File Download Via PowerShell Windows Ingress Tool Transfer Using Explorer Windows Ldifde Directory Object Behavior Windows Process Execution From RDP Share Windows SQL Spawning CertUtil Windows SSH Proxy Command WinRAR Spawning Shell Application Cisco Secure Firewall - Communication Over Suspicious Ports Cisco Secure Firewall - Connection to File Sharing Domain Cisco Secure Firewall - File Download Over Uncommon Port Cisco Secure Firewall - High EVE Threat Confidence Cisco Secure Firewall - Malware File Downloaded Cisco Secure Firewall - Repeated Malware Downloads Cisco Secure Firewall - Snort Rule Triggered Across Multiple Hosts Cisco Secure Firewall - Wget or Curl Download Juniper Networks Remote Code Execution Exploit Detection Any Powershell DownloadFile Any Powershell DownloadString CertUtil Download With URLCache and Split Arguments CertUtil Download With VerifyCtl and Split Arguments Curl Download and Bash Execution Wget Download and Bash Execution Windows CertUtil Download With URL Argument [LLM] AUR build process egress to temp.sh or github.com/fardewoak/nodejs-argo [LLM] AI coding agent (Claude Code / Cursor / Codex) spawning shell that fetch-and-executes remote payload [LLM] File writes to sensitive paths by LangGraph Python/Node runtime [LLM] ShinyHunters staging-server IP connections — SimpleHTTP on TCP/8888 [LLM] Talos prevalent malware hash dropped to disk (DeviceFileEvents pivot) [LLM] Self-hosted AI agent process spawns shell/curl/wget then executes the fetched payload [LLM] Outbound connection or DNS resolution to imperva_artifactory.com (OpenClaw PoC C2) [LLM] Hades on-import payload: python interpreter spawns Bun runtime download [LLM] npm/node install-time spawn downloads Bun runtime (Shai-Hulud worm pattern) [LLM] npm lifecycle script harvests secrets via TruffleHog or chains to GitHub API [LLM] Miasma supply-chain worm leaked repo clone, install or fetch [LLM] MIPS shell-script dropper on Linux edge device — JDY architecture-aware payload fetch [LLM] Python interpreter downloads oven-sh Bun runtime v1.3.14 from GitHub releases at import time [LLM] Earth Dahu / Gamaredon HTA-to-VBScript chain (mshta.exe spawning wscript/cscript) [LLM] Python interpreter downloading Bun runtime ZIP from oven-sh GitHub release [LLM] Phar archive or PHPSpreadsheet RCE marker written by web-server process [LLM] Internal host outbound to CVE-2026-50751 Qilin actor IPs (post-bypass C2 / staging) [LLM] AnyDesk, Bomgar, SuperOps or Zoho Assist installer execution (UNC3753 RMM foothold) [LLM] PowerShell Invoke-WebRequest dropping script.ps1 to user AppData (KongTuke stage-2) [LLM] Same host calling KongTuke C2 from both powershell.exe and curl.exe within short window [LLM] Argamal Stage2 BITSAdmin Pull of zaesdl.dat from GitHub [LLM] Downloader or shell child of npm/pip install (postinstall RAT loader) [LLM] npm/node lifecycle script fetching Bun runtime from github.com/oven-sh/bun [LLM] Bun runtime download to /tmp from a node process during npm install [LLM] Egress to typosquatted C2 flipboxstudio.info (Laravel-Lang Composer SC) [LLM] PHP CLI drops hidden /tmp dropper artefacts (Laravel-Lang autoload payload) [LLM] C2 callback to moika.tech payload distribution infrastructure [LLM] node.exe spawns detached child from tmpdir after npm install (moika.tech dropper) [LLM] PraisonAI python process spawning shell, curl, or wget (post-exploitation tool-use abuse) [LLM] Container egress to cryptominer pool / Kinsing C2 [LLM] payload.bin written under node_modules by node process [LLM] Outbound HTTP beacon to vpmdhaj C2 (aab.sportsontheweb.net) [LLM] Bun runtime download from github.com/oven-sh during npm install (Gen-2 loader) [LLM] axios RAT C2 callout to sfrclak.com / 142.11.206.73:8000 [LLM] Yamcs Java process beacons to webhook / interact / tunneling service (CVE-2026-46621 C2) [LLM] Laravel-Lang stealer file drop in .laravel_locale temp directory [LLM] cscript.exe launching .vbs from .laravel_locale temp directory [LLM] Stealer or VBS launcher dropped into .laravel_locale temp directory [LLM] VS Code/Cursor extension host fetches dropper from nrwl/nx orphan commit on GitHub [LLM] TamperedChef C2 / distribution callback to appsuites.ai and sibling domains [LLM] VS Code child process fetching payload from nrwl/nx orphan commit (Nx Console v18.95.0 dropper) [LLM] WormFrp / Webworm Amazon S3 staging bucket access (wamanharipethe / whpjewellers) [LLM] TeamPCP rope.pyz Dropper Fetch from check.git-service.com C2 [LLM] TeamPCP rope.pyz Dropper Infection Markers on Linux [LLM] Python process executing transformers.pyz dropped from git-tanstack.com (TeamPCP) [LLM] Outbound connection to TeamPCP C2 IP 83.142.209.194 [LLM] mistralai 2.4.6 dropper: curl downloading transformers.pyz from 83.142.209.194 [LLM] Outbound network connection to mistralai 2.4.6 dropper C2 (83.142.209.194) [LLM] Drop of /tmp/transformers.pyz on Linux endpoint [LLM] Malicious node-ipc package landed on disk under node_modules [LLM] DeepSeek-TUI sub-agent shell execution via AGENTS.md prompt injection (CVE-2026-45374) [LLM] Rust cargo-test binary in target/debug/deps spawning shell or network tool (CVE-2026-45311 exploitation) [LLM] CL-STA-1132 EarthWorm staging download from 146.70.100.69:8000/php_sess [LLM] Bun runtime fetched from github.com/oven-sh/bun during npm install (Bitwarden CLI hijack) [LLM] Python child process executing lightning _runtime/start.py bootstrapper [LLM] Mini Shai-Hulud payload file drop: setup.mjs/execution.js by hash & size in node_modules [LLM] Qinglong cryptominer payload download from file.551911.xyz [LLM] Hidden .fullgc cryptominer binary written to /ql/data/db/ [LLM] GPT-Proxy backdoor C2 / Stage-2 download (sync.geeker.indevs.in, gibunxi4201/kube-node-diag) [LLM] Outbound connection to Velora DEX npm supply-chain C2 89.36.224.5 [LLM] node process spawning bash/curl chain to fetch Velora DEX install.sh dropper [LLM] macOS file write of profiler binary to com.apple.Terminal masquerade path [LLM] Malicious axios or plain-crypto-js package files written to node_modules [LLM] hackerbot-claw payload host: DNS/HTTP egress to hackmoltrepeat.com (C2 + exfil) [LLM] hackerbot-claw second-stage download: curl -sSfL pipe-bash from hackmoltrepeat.com/molt [LLM] Outbound fetch of attacker-controlled autoimport VSIX from ColossusQuailPray GitHub release [LLM] IoliteLabs VSCode extension dropper: VS Code child process reaching rraghh.com / oortt.com C2 [LLM] IoliteLabs IOC sweep: rraghh.com / oortt.com hostnames + campaign file hashes [LLM] Outbound connection to TeamPCP C2 83.142.209.203 / ringtone.wav stego payload fetch [LLM] WAV-disguised stager pull from TeamPCP loader 83.142.209.203:8080 [LLM] PowerShell masquerading as Windows Terminal at %PROGRAMDATA%\wt.exe (Axios RAT Windows stage) [LLM] Linux Python RAT orphaned via nohup python3 /tmp/ld.py (Axios npm payload) [LLM] axios RAT artifact dropped: com.apple.act.mond / wt.exe / ld.py with known SHA256 [LLM] TeamPCP C2 egress to 83.142.209.203:8080 (telnyx WAV-stego dropper) [LLM] TeamPCP WAV-stego payload drop (hangup.wav / ringtone.wav) [LLM] gofile.io archive download by browser followed by extracted-EXE execution within 30 minutes [LLM] ForceMemo: Node.js v22.9.0 spawned by Python from user home directory [LLM] Bash-spawned curl to xygeni-action C2 nip.io endpoint with /b/in /b/q /b/r path on CI runner [LLM] Cloudflare-tunnel curl-piped Python stager (kamikaze.sh / kube.py) [LLM] CanisterWorm persistence: pglog/pg_state/internal-monitor systemd unit and /tmp/pglog drop [LLM] GlassWorm Stage-3 RAT installation under %APPDATA%\QtCvyfVWKH\index.js [LLM] VSCode/VSCodium spawning shell or curl to raw.githubusercontent.com/BlokTrooper [LLM] VSCode-family host fetching from raw.githubusercontent.com/BlokTrooper/extension path [LLM] Glassworm side-staged Node.js runtime under %APPDATA%\_node_x86 / _node_x64 [LLM] DRILLAPP variant 2: Edge launched with --remote-debugging-port=9222 for CDP-based file download [LLM] Cacheract memdump.py download/execution on CI runner or developer host [LLM] npm/yarn/pnpm postinstall: Node child egressing to non-registry public host [LLM] Scavenger loader/install.js dropped into node_modules (known SHA256 or filename match) [LLM] tj-actions/changed-files compromise: self-hosted runner egress to nikitastupin memdump gist (CVE-2025-30066) [LLM] Endpoint contact with attacker C2 setup-service.com (OpenClaw skill stager) [LLM] Pastebin-piping stager retrieved from rentry.co/openclaw-core (macOS/Linux ClawHub skill) [LLM] Download of openclawcore-1.0.3.zip from denboss99 GitHub release (Windows OpenClaw skill payload) [LLM] curl | bash or wget | sh executed by Claude/Cursor/OpenClaw agent process [LLM] Executable dropped into C:\inetpub\pub\ shared directory [LLM] DWrite.dll Rust sideloader dropped outside Windows directory (ClawdBot redundant payload) [LLM] VS Code (Code.exe/node) drops payload to %TEMP%\Lightshot staging directory [LLM] G_Wagon dropper: node.exe spawns system tar.exe extracting from stdin (-x -f - -C) [LLM] G_Wagon Python runtime drop into npm cache with lib_core/renderer or python_runtime paths [LLM] Python parent spawns detached 'python3 -' child reading payload from stdin [LLM] Node.js process downloads payload via curl/wget (React2Shell SNOWLIGHT/VShell deployment) [LLM] Sha1-Hulud npm Worm — Egress to bun.sh / oss.trufflehog.org / keychecker.trufflesecurity.com from npm/node context [LLM] NPM preinstall hook fetching Bun installer from bun.sh (Sha1-Hulud dropper) [LLM] LittleDaemon / DaemonicLogistics update-hijack URL pattern (popup_4.2.0.2246.dll, /update/updateInfo.bzp, /update/file6.bdat, /update/file2. [LLM] DaemonicLogistics fake-Tencent payload drop (logo.gif at %PROGRAMDATA%\Tencent\QQUpdateMgr\UpdateFiles) [LLM] CI/CD Linux build host outbound to gist.githubusercontent.com (tj-actions IOC pattern) [LLM] CI/CD runner outbound to gist.githubusercontent.com (tj-actions CVE-2025-30066 staging fetch) [LLM] Scavenger Loader DLL (node-gyp.dll) written inside node_modules of CVE-2025-54313 packages [LLM] ScreenConnect MSI sideload from lmfao.su (Solidity Language post-exploit RAT install) [LLM] Self-hosted GitHub Action runner downloads memdump.py from compromised gist (CVE-2025-30066) [LLM] Outbound fetch of file.sh via attacker-controlled commit d8daa0b... on raw.githubusercontent.com [LLM] Vulnerable Moq 4.20.0 or Devlooped.SponsorLink NuGet package landed on endpointArticles citing this technique (87)
crit 400+ AUR Packages Hijacked: What the “Atomic Arch” Campaign Means for Supply-Chain Security art-14
crit ShinyHunters Exploits Oracle PeopleSoft Zero-Day (CVE-2026-35273) to Breach Universities art-37
high A tale of two eras art-40
high Miasma and Hades Are Spreading Now: Detect Them on Developer Machines with Suspicious Files art-45
high GitHub breached via a malicious VS Code extension: why developer devices are the real target art-238
crit The AntV Supply Chain Campaign Expands: Microsoft's `durabletask` PyPI Package Compromised art-248
crit [GHSA / CRITICAL] GHSA-wx9m-wx4f-4cmg: Malicious dropper in mistralai 2.4.6 PyPI package art-272
crit Malicious node-ipc versions published to npm in suspected maintainer account compromise art-284
high "A Mini Shai-Hulud Has Appeared": Bun-Based Stealer Hits SAP @cap-js and mbt npm Packages art-348
crit ForceMemo: Hundreds of GitHub Python Repos Compromised via Account Takeover and Force-Push art-434
high DRILLAPP: new backdoor targeting Ukrainian entities with possible links to Laundry Bear art-470