---
{
  "title": "Ingress Tool Transfer",
  "summary": "Ingress tool transfer brings additional files into an already-accessed environment.",
  "topic": "networking",
  "level": "Intermediate",
  "updated": "2026-10-12",
  "published": "2026-10-04",
  "units": [
    2
  ],
  "aliases": [
    "T1105"
  ],
  "sources": [
    {
      "title": "MITRE ATT&CK T1105: Ingress Tool Transfer",
      "url": "https://attack.mitre.org/techniques/T1105"
    }
  ],
  "editorialVersion": 2
}
---

## What it means

Ingress tool transfer brings additional files into an already-accessed environment. Downloaded content may support execution, collection, or later movement.


## An investigation example

A suspicious session retrieves an executable into a writable directory and starts it shortly afterward.

## Evidence to examine

Review transfer origin, file hash, storage path, initiating process, and subsequent execution or copying.

## A common analytical pitfall

A download alone does not establish execution, and a known tool can be used for either approved or unauthorized work.

## Response considerations

Preserve the transferred artifact, verify its use, and investigate how the initiating session gained authority.


## Bringing a file in is not the same as executing it

Ingress tool transfer moves material into an environment after or during unauthorized activity. The incoming content may be an executable, script, configuration, or other component. A download record establishes transfer-related activity, while successful file creation and later execution require their own evidence. Keep those stages separate when estimating impact.

Downloads are also routine. Administrators, package managers, browsers, and deployment tools retrieve software legitimately. Assess the source, requesting process, account, destination path, file identity, and approved purpose. A recognizable hosting service does not guarantee that the particular file or account is trusted.

## A fictional unexpected utility

An academy's endpoint logs show a command interpreter retrieving a file into a temporary folder after unusual account activity. Analysts correlate the request, file hash, process ancestry, and any subsequent launch. They compare the sequence with approved support work and preserve the downloaded material through an appropriate evidence-handling process.

Do not run an unknown recovered file on a personal device to learn what it does. Use the organization's approved analysis route. If telemetry records only a request, the transfer may have failed or produced different content than expected. The report should reflect the actual response and file evidence rather than assume success.

## Trace a harmless download

For a training environment, use a benign file from an approved source or prepared logs. Record the requesting process, destination, file identity, and whether execution occurred. Explain which evidence supports each statement. Then identify what would make the same sequence concerning in a business environment.

Containment should consider how the requester gained authority and whether other material arrived. Removing one file does not necessarily remove the access path that delivered it. Review related sessions, created components, and subsequent behavior through a coordinated incident plan.

## Related concepts

- [[packet-analysis]]
- [[exfiltration]]
- [[network-segmentation]]
- [[lateral-tool-transfer]]
- [[command-and-scripting-interpreter]]
- [[user-execution]]
- [[web-service]]