Techniques › T1105
T1105 Ingress Tool Transfer
command and control — ESXi, Linux, macOS, Network Devices, Windows · attack.mitre.org · JSON
1
MITRE detection strategy
5
analytics
87
Sigma rules tagged attack.t1105
35
KEV CVEs mapped here
<p>Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp. Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer).</p><p>On Windows, adversaries may use various utilities to download tools, such as
copy, finger, certutil, and PowerShell commands such as <code>IEX(New-Object Net.WebClient).downloadString()</code> and <code>Invoke-WebRequest</code>. On Linux and macOS systems, a variety of utilities also exist, such as curl, scp, sftp, tftp, rsync, finger, and wget. A number of these tools, such as wget, curl, and scp, also exist on ESXi. After downloading a file, a threat actor may attempt to verify its integrity by checking its hash value (e.g., via certutil -hashfile).</p><p>Adversaries may also abuse installers and package managers, such as yum or winget, to download tools to victim hosts. Adversaries have also abused file application features, such as the Windows search-ms protocol handler, to deliver malicious files to victims through remote file searches invoked by User Execution (typically after interacting with Phishing lures).</p><p>Files can also be transferred using various Web Services as well as native or otherwise present tools on the victim system. In some cases, adversaries may be able to leverage services that sync between a web-based and an on-premises client, such as Dropbox or OneDrive, to transfer files onto victim systems. For example, by compromising a cloud account and logging into the service's web portal, an adversary may be able to trigger an automatic syncing process that transfers the file onto the victim's machine.</p>KEV CVEs mapped to this technique · CTID Mappings Explorer
| CVE | Vendor / product | Mapping type | State | Added |
|---|---|---|---|---|
| CVE-2025-43200 | Apple Multiple Products | primary impact | Mapped | 2025-06-16 |
| CVE-2025-31201 | Apple Multiple Products | primary impact | Stale | 2025-04-17 |
| CVE-2025-31200 | Apple Multiple Products | primary impact | Stale | 2025-04-17 |
| CVE-2024-23692 | Rejetto HTTP File Server | secondary impact | Mapped | 2024-07-09 |
| CVE-2024-4978 | Justice AV Solutions Viewer | primary impact | Mapped | 2024-05-29 |
| CVE-2023-48788 | Fortinet FortiClient EMS | secondary impact | Mapped | 2024-03-25 |
| CVE-2023-29300 | Adobe ColdFusion | primary impact | Mapped | 2024-01-08 |
| CVE-2023-38203 | Adobe ColdFusion | primary impact | Mapped | 2024-01-08 |
| CVE-2023-7101 | Spreadsheet::ParseExcel Spreadsheet::ParseExcel | secondary impact | Mapped | 2024-01-02 |
| CVE-2023-22518 | Atlassian Confluence Data Center and Server | secondary impact | Mapped | 2023-11-07 |
| CVE-2023-38831 | RARLAB WinRAR | secondary impact | Mapped | 2023-08-24 |
| CVE-2023-38035 | Ivanti Sentry | secondary impact | Mapped | 2023-08-22 |
| CVE-2023-3519 | Citrix NetScaler ADC and NetScaler Gateway | primary impact | Mapped | 2023-07-19 |
| CVE-2023-20867 | VMware Tools | secondary impact | Mapped | 2023-06-23 |
| CVE-2023-34362 | Progress MOVEit Transfer | secondary impact | Mapped | 2023-06-02 |
| CVE-2023-2868 | Barracuda Networks Email Security Gateway (ESG) Appliance | secondary impact | Mapped | 2023-05-26 |
| CVE-2023-27350 | PaperCut MF/NG | secondary impact | Mapped | 2023-04-21 |
| CVE-2023-26360 | Adobe ColdFusion | secondary impact | Mapped | 2023-03-15 |
| CVE-2022-30190 | Microsoft Windows | primary impact | Mapped | 2022-06-14 |
| CVE-2012-0754 | Adobe Flash Player | primary impact | Mapped | 2022-06-08 |
| CVE-2010-1297 | Adobe Flash Player | primary impact | Mapped | 2022-06-08 |
| CVE-2016-0984 | Adobe Flash Player and AIR | primary impact | Mapped | 2022-05-25 |
| CVE-2015-8651 | Adobe Flash Player | primary impact | Mapped | 2022-05-25 |
| CVE-2010-2861 | Adobe ColdFusion | primary impact | Mapped | 2022-03-25 |
| CVE-2017-11292 | Adobe Flash Player | primary impact | Mapped | 2022-03-03 |
| CVE-2016-4117 | Adobe Flash Player | primary impact | Mapped | 2022-03-03 |
| CVE-2016-1019 | Adobe Flash Player | primary impact | Mapped | 2022-03-03 |
| CVE-2015-5119 | Adobe Flash Player | primary impact | Mapped | 2022-03-03 |
| CVE-2013-0641 | Adobe Reader | primary impact | Mapped | 2022-03-03 |
| CVE-2012-1535 | Adobe Flash Player | primary impact | Mapped | 2022-03-03 |
| CVE-2011-0611 | Adobe Flash Player | primary impact | Mapped | 2022-03-03 |
| CVE-2010-0188 | Adobe Reader and Acrobat | primary impact | Mapped | 2022-03-03 |
| CVE-2018-15982 | Adobe Flash Player | primary impact | Mapped | 2022-02-15 |
| CVE-2021-44515 | Zoho Desktop Central | primary impact | Mapped | 2021-12-10 |
| CVE-2021-35394 | Realtek Jungle Software Development Kit (SDK) | secondary impact | Mapped | 2021-12-10 |
Detection strategy · ATT&CK Enterprise v19.2
- DET0060 Detect Ingress Tool Transfers via Behavioral Chain v1.0
AN0165 WindowsUnusual or uncommon processes initiate network connections to external destinations followed by file creation (tools downloaded).Tunable:
ParentProcessNameDestinationIPCategoryFilePathRegexAN0166 LinuxShell-based tools (curl, wget, scp) initiate connections to external domains followed by creation of executable files on disk.Tunable:ToolNameDownloadExtensionAN0167 macOSProcess execution of curl or wget followed by a network connection and a file created in temporary or user-specific directories.Tunable:DirectoryTargetedProcessPathAN0168 ESXiCommand line interface or vCLI triggers remote transfer using wget or curl, writing files into datastore paths or local tmp directories.Tunable:ToolNameDatastorePathAN0169 Network DevicesNetwork device logs show anomalous inbound file transfers or uncharacteristic flows with high payload volume to network devices with storage or automation hooks.Tunable:PayloadVolumeThresholdProtocolUsed
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1105
Author: Nasreddine Bencherchali (Nextron Systems), Cedric MAURUGEON (Update)
· 2022-09-15 (modified 2023-05-02) · logsource: product=linux category=process_creation · 00b90cc1-17ec-402c-96ad-3a8117d7a582
Detects a suspicious curl process start the adds a file to a web request
Author: Florian Roth (Nextron Systems), Cedric MAURUGEON (Update)
· 2020-07-03 (modified 2023-05-02) · logsource: product=windows category=process_creation · 00bca14a-df4e-4649-9054-3f2aa676bc04
Detects the execution of the "curl" process with "upload" flags. Which might indicate potential data exfiltration
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
· 2021-12-27 (modified 2022-08-02) · logsource: product=windows category=process_creation · 00d49ed5-4491-4271-a8db-650a4ef6f8c1
Detects suspicious ways to download files from Microsoft domains that are used to store attachments in Emails or OneNote documents
Author: frack113
· 2022-12-25 · logsource: product=windows category=process_creation · 02b64f1b-3f33-4e67-aede-ef3b0a5a8fcf
Detects usage of COM objects that can be abused to download files in PowerShell by CLSID
Author: Furkan CALISKAN, @caliskanfurkan_, @oscd_initiative, Nasreddine Bencherchali (Nextron Systems)
· 2020-10-05 (modified 2024-03-05) · logsource: product=windows category=process_creation · 04936b66-3915-43ad-a8e5-809eadfd1141
Detects execution of findstr with the "s" and "i" flags for a "subfolder" and "insensitive" search respectively. Attackers sometimes leverage this built-in utility to search the system for interesting files or filter through results of commands.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-06-13 · logsource: product=windows category=image_load · 04fc4b22-91a6-495a-879d-0144fec5ec03
Detects potential exploitation of remote code execution vulnerability CVE-2025-33053
by monitoring suspicious image loads from WebDAV paths. The exploit involves malicious executables from
attacker-controlled WebDAV servers loading the Windows system DLLs like gdi32.dll, netapi32.dll, etc.
Author: frack113
· 2022-08-28 (modified 2024-05-31) · logsource: product=windows category=network_connection · 08249dc0-a28d-4555-8ba5-9255a198e08c
Detects a script interpreter (Wscript/Cscript) initiating a local network connection to download or execute a script hosted on a shared folder.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2026-04-01 · logsource: product=linux category=process_creation · 0a23a62d-c5b3-468b-a072-25064a9a8c87
Detects the Linux-specific execution chain of the plain-crypto-js malicious npm dependency by Axios NPM package, including payload download via curl and detached execution using nohup and python3.
On March 30, 2026, malicious versions (1.14.1, 0.30.4) were published to npm, injecting a dependency (plain-crypto-js@4.2.1) that executed a postinstall script as a cross-platform RAT dropper.
The dropper contacted a C2 server, delivered platform-specific payloads, deleted itself, and replaced package.json to evade detection.
Author: frack113, Florian Roth (Nextron Systems)
· 2022-09-02 (modified 2024-05-31) · logsource: product=windows category=network_connection · 0dba975d-a193-4ed1-a067-424df57570d1
Detects a network connection initiated by the certutil.exe utility.
Attackers can abuse the utility in order to download malware or additional payloads.
Author: Sreeman, Florian Roth (Nextron Systems)
· 2022-01-04 (modified 2025-10-07) · logsource: product=windows category=process_creation · 0e8cfe08-02c9-4815-a2f8-0d157b7ed33e
Detects execution of chromium based browser in headless mode using the "dump-dom" command line to download files
Author: Florian Roth (Nextron Systems), Hieu Tran
· 2023-03-13 (modified 2025-07-18) · logsource: product=windows category=process_creation · 0f0450f3-8b47-441e-a31b-15a91dc243e2
Detects potential DLL files being downloaded using the PowerShell Invoke-WebRequest or Invoke-RestMethod cmdlets.
Author: Sohan G (D4rkCiph3r), Red Canary (idea)
· 2023-08-22 · logsource: product=macos category=process_creation · 13db8d2e-7723-4c2c-93c1-a4d36994f7ef
Detects potential in-memory downloading and compiling of applets using curl and osacompile as seen used by XCSSET malware
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-02-15 (modified 2025-12-01) · logsource: product=windows category=process_creation · 13e6fe51-d478-4c7e-b0f2-6da9b400a829
Detects the execution of certutil with certain flags that allow the utility to download files from direct IPs.
Author: frack113
· 2021-11-26 (modified 2022-08-13) · logsource: product=windows category=process_creation · 185d7418-f250-42d0-b72e-0c8b70661e93
Download and compress a remote file and store it in a cab file on local machine.
Author: Florian Roth (Nextron Systems)
· 2017-11-08 (modified 2023-05-18) · logsource: category=proxy · 195c1119-ef07-4909-bb12-e66f5e07bf3c
Detects download of certain file types from hosts with dynamic DNS names (selected list)
Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community, Nasreddine Bencherchali (Nextron Systems)
· 2023-02-15 (modified 2025-12-01) · logsource: product=windows category=process_creation · 19b08b1c-861d-4e75-a1ef-ea0c1baf202b
Detects the execution of certutil with certain flags that allow the utility to download files.
Author: Micah Babinski
· 2023-10-15 · logsource: product=windows category=file_event · 1a433e1d-03d2-47a6-8063-ece992cf4e73
Detects the usage of curl.exe, KeyScramblerLogon, or other non-standard/suspicious processes used to create Autoit3.exe.
This activity has been associated with DarkGate malware, which uses Autoit3.exe to execute shellcode that performs
process injection and connects to the DarkGate command-and-control server. Curl, KeyScramblerLogon, and these other
processes consitute non-standard and suspicious ways to retrieve the Autoit3 executable.
Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community
· 2019-01-16 (modified 2021-11-27) · logsource: product=windows category=process_creation · 1ac8666b-046f-4201-8aba-1951aaec03a3
Detects a suspicious command line execution that includes an URL and AppData string in the command line parameters as used by several droppers (js/vbs > powershell)
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-12-10 · logsource: product=windows category=file_event · 1cf465a1-2609-4c15-9b66-c32dbe4bfd67
Detects legitimate applications writing any type of file to uncommon or suspicious locations that are not typical for application data storage or execution.
Adversaries may leverage legitimate applications (Living off the Land Binaries - LOLBins) to drop or download malicious files to uncommon locations on the system to evade detection by security solutions.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-02-05 · logsource: product=windows category=process_creation · 1d174d38-8fda-4081-a9b6-56d9763c0cd8
Detects the creation of a scheduled task using schtasks.exe, potentially in combination with curl for downloading payloads and PowerShell for executing them.
This facilitates executing malicious payloads or connecting with C&C server persistently without dropping the malware sample on the host.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-04-21 · logsource: product=windows category=process_creation · 1edff897-9146-48d2-9066-52e8d8f80a2f
Detects calls to PowerShell with Invoke-WebRequest cmdlet using direct IP access
Author: Tim Rauch, Elastic (idea)
· 2022-09-27 · logsource: product=windows category=process_creation · 214641c2-c579-4ecb-8427-0cf19df6842e
Detects the desktopimgdownldr utility being used to download a remote file. An adversary may use desktopimgdownldr to download arbitrary files as an alternative to certutil.
Author: Sreeman, Nasreddine Bencherchali (Nextron Systems)
· 2020-01-13 (modified 2024-03-05) · logsource: product=windows category=process_creation · 21dd6d38-2b18-4453-9404-a0fe4a0cc288
Adversaries can use curl to download payloads remotely and execute them. Curl is included by default in Windows 10 build 17063 and later.
Author: Meroujan Antonyan (vx3r)
· 2025-06-05 · logsource: product=windows category=process_creation · 222720a7-047f-4054-baa5-bab9be757db0
Detects the execution of PowerShell commands that attempt to install MSI packages via the
Windows Installer COM object (`WindowsInstaller.Installer`) hosted remotely.
This could be indication of malicious software deployment or lateral movement attempts using Windows Installer functionality.
And the usage of WindowsInstaller COM object rather than msiexec could be an attempt to bypass the detection.
Author: Florian Roth (Nextron Systems)
· 2022-04-20 · logsource: product=windows category=network_connection · 25eabf56-22f0-4915-a1ed-056b8dae0a68
Detects an executable that isn't dropbox but communicates with the Dropbox API
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2026-04-01 · logsource: product=macos category=file_event · 2db0458c-05c9-4069-a26f-77becd9c8c13
Detects file creation events linked to the Axios NPM supply chain compromise on macOS devices. Axios is a popular JavaScript HTTP client.
On March 30, 2026, malicious versions (1.14.1, 0.30.4) were published to npm, injecting a dependency (plain-crypto-js@4.2.1) that executed a postinstall script as a cross-platform RAT dropper.
Remote Access Tool - TacticalRMM Agent Registration to Potentially Attacker-Controlled Server
mediumexperimental
Author: Ahmed Nosir (@egycondor)
· 2025-05-29 · logsource: product=windows category=process_creation · 2db93a3f-3249-4f73-9e68-0e77a0f8ae7e
Detects TacticalRMM agent installations where the --api, --auth, and related flags are used on the command line.
These parameters configure the agent to connect to a specific RMM server with authentication, client ID, and site ID.
This technique could indicate a threat actor attempting to register the agent with an attacker-controlled RMM infrastructure silently.
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
· 2022-06-28 (modified 2025-12-10) · logsource: product=windows category=process_creation · 2ddef153-167b-4e89-86b6-757a9e65dcac
Detects usage of bitsadmin downloading a file to a suspicious target folder
Author: Florian Roth (Nextron Systems)
· 2017-03-05 (modified 2026-04-28) · logsource: product=windows category=ps_classic_start · 3236fcd0-b7e3-4433-b4f8-86ad61a9af2d
Detects PowerShell download activity, via the .DownloadFile() or .DownloadString() methods of the Net.WebClient class.
This technique is often abused by attackers to download additional payloads.
Author: Joseliyo Sanchez, @Joseliyo_Jstnk
· 2023-06-02 · logsource: product=linux category=file_event · 35a05c60-9012-49b6-a11f-6bab741c9f74
Detects the use of wget to download content in a temporary directory such as "/tmp" or "/var/tmp"
Author: Florian Roth (Nextron Systems)
· 2020-05-20 (modified 2023-03-09) · logsource: product=windows category=process_creation · 3711eee4-a808-4849-8a14-faf733da3612
Detects tools and process executions used by Greenbug in their May 2020 campaign as reported by Symantec
Author: frack113
· 2022-05-28 (modified 2023-08-17) · logsource: product=windows category=registry_set · 3aff0be0-7802-4a7e-a4fa-c60c74bc5e1d
Detects setting a custom URL for OneDriveStandaloneUpdater.exe to download a file from the Internet without executing any
anomalous executables with suspicious arguments. The downloaded file will be in C:\Users\redacted\AppData\Local\Microsoft\OneDrive\StandaloneUpdaterreSignInSettingsConfig.json
Author: Omar Khaled (@beacon_exe)
· 2024-08-21 · logsource: product=macos category=process_creation · 3b2c1059-ae5f-40b6-b5d4-6106d3ac20fe
Detects the execution of the "chflags" utility with the "hidden" flag, in order to hide files on MacOS.
When a file or directory has this hidden flag set, it becomes invisible to the default file listing commands and in graphical file browsers.
Author: frack113
· 2022-12-25 · logsource: product=windows category=ps_script · 3c7d1587-3b13-439f-9941-7d14313dbdfe
Detects usage of COM objects that can be abused to download files in PowerShell by CLSID
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-02-15 (modified 2026-03-29) · logsource: product=windows category=process_creation · 42a5f1e7-9603-4f6d-97ae-3f37d130d794
Detects the execution of certutil with certain flags that allow the utility to download files from file-sharing websites.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-06-10 (modified 2023-03-02) · logsource: product=windows category=process_creation · 44143844-0631-49ab-97a0-96387d6b2d7c
Detects execution of the Notepad++ updater (gup) from a process other than Notepad++ to download files.
Author: Christian Burkard (Nextron Systems)
· 2021-11-24 (modified 2025-10-29) · logsource: product=windows category=process_creation · 4480827a-9799-4232-b2c4-ccc6c4e9e12b
Detects a suspicious CertReq execution downloading a file.
This behavior is often used by attackers to download additional payloads or configuration files.
Certreq is a built-in Windows utility used to request and retrieve certificates from a certification authority (CA). However, it can be abused by threat actors for malicious purposes.
Author: Matthew Matchen
· 2020-09-04 (modified 2023-11-09) · logsource: product=windows category=process_creation · 46123129-1024-423e-9fae-43af4a0fa9a5
Detects the use of Windows Defender MpCmdRun.EXE to download files
Author: Florian Roth (Nextron Systems)
· 2017-06-01 (modified 2022-10-09) · logsource: product=windows category=registry_event · 47e0852a-cf81-4494-a8e6-31864f8c86ed
Detects Pandemic Windows Implant
Author: Florian Roth (Nextron Systems)
· 2022-05-09 · logsource: product=windows service=security · 54f0434b-726f-48a1-b2aa-067df14516e4
Detects the extraction of password protected ZIP archives with suspicious file names. See the filename variable for more details on which file has been opened.
Author: Furkan CALISKAN, @caliskanfurkan_, @oscd_initiative, Nasreddine Bencherchali (Nextron Systems)
· 2020-10-05 (modified 2024-03-05) · logsource: product=windows category=process_creation · 587254ee-a24b-4335-b3cd-065c0f1f4baa
Detects execution of "findstr" with specific flags and a remote share path. This specific set of CLI flags would allow "findstr" to download the content of the file located on the remote share as described in the LOLBAS entry.
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
· 2022-06-28 (modified 2023-05-30) · logsource: product=windows category=process_creation · 5b80a791-ad9b-4b75-bcc1-ad4e1e89c200
Detects usage of bitsadmin downloading a file with a suspicious extension
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-08-02 (modified 2025-07-18) · logsource: product=windows category=process_creation · 5e3cc4d8-3e68-43db-8656-eaaeefdec9cc
Detects a suspicious call to Invoke-WebRequest cmdlet where the and output is located in a suspicious location
Author: Austin Clark
· 2019-08-12 (modified 2023-01-04) · logsource: product=cisco service=aaa · 5e51acb2-bcbe-435b-99c6-0e3cd5e2aa59
Various protocols maybe used to put data on the device for exfil or infil
Author: Josh Nickels, Michael Taggart
· 2025-05-22 · logsource: product=windows category=file_event · 6c0ce3b6-85e2-49d4-9c3f-6e008ce9796e
Detects Deno writing a file from a direct HTTP(s) call and writing to the appdata folder or bringing it's own malicious DLL.
This behavior may indicate an attempt to execute remotely hosted, potentially malicious files through deno.
Author: Daniel Cortez
· 2024-06-04 · logsource: product=macos category=process_creation · 6d8a7cf1-8085-423b-b87d-7e880faabbdf
Detects the execution of the nscurl utility in order to download files.
Author: @gott_cyber
· 2022-09-02 (modified 2023-03-14) · logsource: product=windows category=process_creation · 6f535e01-ca1f-40be-ab8d-45b19c0c8b7f
Detects the execution of "Ldifde.exe" with the import flag "-i". The can be abused to include HTTP-based arguments which will allow the arbitrary download of files from a remote server.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-05-16 (modified 2023-10-18) · logsource: product=windows category=process_creation · 70ad0861-d1fe-491c-a45f-fa48148a300d
Detects when a user downloads a file by using CertOC.exe
Author: frack113
· 2022-08-28 (modified 2024-11-23) · logsource: product=windows category=process_creation · 74a12f18-505c-4114-8d0b-8448dd5485c6
Detects the usage of nimgrab, a tool bundled with the Nim programming framework and used for downloading files.
Author: Ömer Günal
· 2020-06-18 · logsource: product=linux · 7a14080d-a048-4de8-ae58-604ce58a795b
Detects the use of tools that copy files from or to remote systems
Network Connection Initiated From Process Located In Potentially Suspicious Or Uncommon Location
hightest
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
· 2017-03-19 (modified 2026-03-29) · logsource: product=windows category=network_connection · 7b434893-c57d-4f41-908d-6a17bf1ae98f
Detects a network connection initiated by programs or processes running from suspicious or uncommon files system locations.
Author: frack113
· 2021-11-24 (modified 2023-11-09) · logsource: product=windows category=dns_query · 7cff77e1-9663-46a3-8260-17f2e1aa9d0a
Detects DNS queries made by "AppInstaller.EXE". The AppInstaller is the default handler for the "ms-appinstaller" URI. It attempts to load/install a package from the referenced URL
Author: Florian Roth (Nextron Systems)
· 2022-06-28 (modified 2026-03-29) · logsource: product=windows category=process_creation · 8518ed3d-f7c9-4601-a26c-f361a4256a0c
Detects usage of bitsadmin downloading a file from a suspicious domain
Author: frack113
· 2022-01-22 (modified 2023-11-09) · logsource: product=windows category=network_connection · 8d7e392e-9b28-49e1-831d-5949c6281228
Detects a network connection initiated by IMEWDBLD.EXE. This might indicate potential abuse of the utility as a LOLBIN in order to download arbitrary files or additional payloads.
Author: frack113
· 2022-03-06 (modified 2024-03-13) · logsource: product=windows category=process_creation · 9292293b-8496-4715-9db6-37028dcda4b3
Detects the use of Replace.exe which can be used to replace file with another file
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
· 2022-01-11 (modified 2025-10-27) · logsource: product=windows category=process_creation · 94771a71-ba41-4b6e-a757-b531372eaab6
Detects execution of a browser process with a URL argument pointing to a file with a potentially interesting extension. This can be abused to download arbitrary files or to hide from the user for example by launching the browser in a minimized state.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-05-16 (modified 2023-11-09) · logsource: product=windows category=process_creation · 9801abb8-e297-4dbf-9fbd-57dde0e830ad
Detects execution of the IEExec utility to download and execute files
Author: frack113, Florian Roth (Nextron Systems)
· 2022-08-28 (modified 2024-03-13) · logsource: product=windows category=network_connection · 992a6cae-db6a-43c8-9cec-76d7195c96fc
Detects a script interpreter wscript/cscript opening a network connection to a non-local network. Adversaries may use script to download malicious payloads.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-06-13 · logsource: product=windows category=process_access · 9a2d8b3e-f5a1-4c68-9e21-7d9e1cf8a123
Detects potential exploitation of remote code execution vulnerability CVE-2025-33053
by looking for process access that involves legitimate Windows executables (iediagcmd.exe, CustomShellHost.exe)
accessing suspicious executables hosted on WebDAV shares. This indicates an attacker may be exploiting
Process.Start() search order manipulation to execute malicious code from attacker-controlled WebDAV servers
instead of legitimate system binaries. The vulnerability allows unauthorized code execution through
external control of file names or paths via WebDAV.
Author: Florian Roth (Nextron Systems)
· 2022-07-05 (modified 2023-02-21) · logsource: product=windows category=process_creation · 9a517fca-4ba3-4629-9278-a68694697b81
Detects file download using curl.exe
Author: @kostastsale
· 2026-02-19 · logsource: product=windows category=file_event · 9e4b7d3a-6f2c-4e9a-8d1b-3c5e7a9f2b4d
Detects the creation of potentially suspicious files by OpenEDR's ITSMService process.
The ITSMService is responsible for remote management operations and can create files on the system through the Process Explorer or file management features.
While legitimate for IT operations, creation of executable or script files could indicate unauthorized file uploads, data staging, or malicious file deployment.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2026-04-01 · logsource: product=macos category=process_creation · a09ee860-31b3-4586-8a68-0ebd74ce0e5f
Detects the macOS-specific execution chain of the plain-crypto-js malicious npm dependency in Axios NPM Package, including AppleScript execution via osascript, payload download, permission modification, execution, and cleanup.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-12-14 · logsource: product=windows category=process_creation · aa0b3a82-eacc-4ec3-9150-b5a9a3e3f82f
Detects usage of the "type" command to download/upload data from WebDAV server
Author: frack113
· 2021-11-26 (modified 2022-08-13) · logsource: product=windows category=process_creation · aa8e035d-7be4-48d3-a944-102aec04400d
Download or Copy file with Extrac32
Author: SOC Prime, Adam Swan
· 2020-05-01 (modified 2021-11-27) · logsource: product=zeek service=http · aac2fd97-bcba-491b-ad66-a6edf89c71bf
Detects executable access via webdav6. Can be seen in APT 29 such as from the emulated APT 29 hackathon https://github.com/OTRF/detection-hackathon-apt29/
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-06-13 · logsource: product=windows category=process_creation · abe06362-a5b9-4371-8724-ebd00cd48a04
Detects potential exploitation of remote code execution vulnerability CVE-2025-33053
which involves unauthorized code execution via WebDAV through external control of file names or paths.
The exploit abuses legitimate utilities like iediagcmd.exe or CustomShellHost.exe by manipulating
their working directories to point to attacker-controlled WebDAV servers, causing them to execute
malicious executables (like route.exe) from the WebDAV path instead of legitimate system binaries
through Process.Start() search order manipulation.
Author: Florian Roth (Nextron Systems), omkar72, oscd.community
· 2021-02-24 (modified 2024-06-27) · logsource: product=windows category=process_creation · af491bca-e752-4b44-9c86-df5680533dbc
Detects execution of the "finger.exe" utility.
Finger.EXE or "TCPIP Finger Command" is an old utility that is still present on modern Windows installation. It Displays information about users on a specified remote computer (typically a UNIX computer) that is running the finger service or daemon.
Due to the old nature of this utility and the rareness of machines having the finger service. Any execution of "finger.exe" can be considered "suspicious" and worth investigating.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2026-04-01 · logsource: product=linux category=file_event · b7cb840c-11f6-47f7-b3ef-5524739c9077
Detects file creation events linked to the Axios NPM supply chain compromise. Axios is a popular JavaScript HTTP client.
On March 30, 2026, malicious versions (1.14.1, 0.30.4) were published to npm, injecting a dependency (plain-crypto-js@4.2.1) that executed a postinstall script as a cross-platform RAT dropper.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-10-18 · logsource: product=windows category=process_creation · b86f6dea-0b2f-41f5-bdcc-a057bd19cd6a
Detects when a user downloads a file from an IP based URL using CertOC.exe
Author: Florian Roth (Nextron Systems)
· 2020-07-03 (modified 2021-11-27) · logsource: product=windows category=process_creation · bb58aa4a-b80b-415a-a2c0-2f65a4c81009
Detects a suspicious Microsoft desktopimgdownldr execution with parameters used to download files from the Internet
Author: Florian Roth (Nextron Systems)
· 2022-07-05 (modified 2023-02-21) · logsource: product=windows category=process_creation · bbeaed61-1990-4773-bf57-b81dbad7db2d
Detects a curl process start on Windows, which could indicates a file download from a remote location or a simple web request to a remote server
Author: Florian Roth (Nextron Systems)
· 2024-05-31 · logsource: product=windows category=network_connection · bcb03938-9f8b-487d-8d86-e480691e1d71
Detects a network connection initiated from a process located in the "C:\Users\Public" folder.
Attacker are known to drop their malicious payloads and malware in this directory as its writable by everyone.
Use this rule to hunt for potential suspicious or uncommon activity in your environement.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-05-19 · logsource: product=windows category=network_connection · c3dbbc9f-ef1d-470a-a90a-d343448d5875
Detects an a non-browser process interacting with the Telegram API which could indicate use of a covert C2
Author: frack113
· 2022-05-02 · logsource: product=windows category=process_creation · cafeeba3-01da-4ab4-b6c4-a31b1d9730c7
Detects the execution of the LOLBIN PrintBrm.exe, which can be used to create or extract ZIP files. PrintBrm.exe should not be run on a normal workstation.
Author: Joseliyo Sanchez, @Joseliyo_Jstnk
· 2023-06-02 · logsource: product=linux category=process_creation · cf610c15-ed71-46e1-bdf8-2bd1a99de6c4
Detects the use of wget to download content to a suspicious directory
Author: Michael Haag, FPT.EagleEye
· 2017-03-09 (modified 2023-02-15) · logsource: product=windows category=process_creation · d059842b-6b9d-4ed1-b5c3-5b89143c6ede
Detects usage of bitsadmin downloading a file
Network Communication Initiated To File Sharing Domains From Process Located In Suspicious Folder
hightest
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
· 2018-08-30 (modified 2026-03-29) · logsource: product=windows category=network_connection · e0f8ab85-0ac9-423b-a73a-81b3c7b1aa97
Detects executables located in potentially suspicious directories initiating network connections towards file sharing domains.
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
· 2020-07-03 (modified 2023-02-21) · logsource: product=windows category=process_creation · e218595b-bbe7-4ee5-8a96-f32a24ad3468
Detects a suspicious curl process start on Windows and outputs the requested document to a local file
Author: Alejandro Houspanossian ('@lekz86')
· 2024-01-02 · logsource: product=windows category=process_creation · e5144106-8198-4f6e-bfc2-0a551cc8dd94
Detects the execution of concatenated commands via "cmd.exe". Pikabot often executes a combination of multiple commands via the command handler "cmd /c" in order to download and execute additional payloads.
Commands such as "curl", "wget" in order to download extra payloads. "ping" and "timeout" are abused to introduce delays in the command execution and "Rundll32" is also used to execute malicious DLL files.
In the observed Pikabot infections, a combination of the commands described above are used to orchestrate the download and execution of malicious DLL files.
Author: Micah Babinski
· 2025-11-25 · logsource: product=windows category=file_event · e890acee-d488-420e-8f20-d9b19b3c3d43
Detects instances where the ArcGIS Server process ArcSOC.exe, which hosts REST services running on an ArcGIS
server, creates a file with suspicious file type, indicating that it may be an executable, script file,
or otherwise unusual.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-09-15 · logsource: product=linux category=process_creation · ea34fb97-e2c4-4afb-810f-785e4459b194
Detects a curl process start on linux, which indicates a file download from a remote location or a simple web request to a remote server
Author: Victor Sergeev, oscd.community
· 2020-10-09 (modified 2023-10-18) · logsource: product=windows category=process_creation · eee00933-a761-4cd0-be70-c42fe91731e7
Detects execution of GfxDownloadWrapper.exe with a URL as an argument to download file.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-09-12 · logsource: product=windows category=process_creation · ef9dcfed-690c-4c5d-a9d1-482cd422225c
Detects execution of Chromium based browser in headless mode
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2026-04-01 · logsource: product=windows category=process_creation · f6c27ecc-d890-4452-80e6-2e274a10e097
Detects the specific Windows execution chain and process tree associated with the Axios NPM supply chain compromise.
On March 30, 2026, malicious versions (1.14.1, 0.30.4) were published to npm, injecting a dependency (plain-crypto-js@4.2.1) that executed a postinstall script as a cross-platform RAT dropper.
The dropper contacted a C2 server, delivered platform-specific payloads, deleted itself, and replaced package.json to evade detection.
The attack used cscript.exe (VBScript), curl.exe (C2), and PowerShell masquerading as Windows Terminal.
Author: Florian Roth (Nextron Systems)
· 2018-02-09 (modified 2022-01-07) · logsource: product=windows category=process_creation · f7b5f842-a6af-4da5-9e95-e32478f3cd2f
Detects suspicious msiexec process starts with web addresses as parameter
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-06-13 · logsource: product=windows category=process_creation · f8de9dd5-7a63-4cfd-9d0c-ae124878b5a9
Detects execution of processes with image paths starting with WebDAV shares (\\), which might indicate malicious file execution from remote web shares.
Execution of processes from WebDAV shares can be a sign of lateral movement or exploitation attempts, especially if the process is not a known legitimate application.
Exploitation Attempt of vulnerabilities like CVE-2025-33053 also involves executing processes from WebDAV paths.
Author: Florian Roth (Nextron Systems)
· 2020-07-03 (modified 2022-06-02) · logsource: product=windows category=file_event · fc4f4817-0c53-4683-a4ee-b17a64bc1039
Detects a suspicious Microsoft desktopimgdownldr file creation that stores a file to a suspicious location or contains a file with a suspicious extension