AdversaryGraph public intelligence page

This page is part of Threat Matrix, the public browser workspace for the main AdversaryGraph platform. Use it for ATT&CK pivots, actor and technique context, similarity leads, detection coverage review, and analyst-ready investigation paths.

Validation disclaimer: TTP overlap, actor similarity, generated summaries, and coverage findings are investigation leads, not attribution proof or operational validation without analyst review.

Main AdversaryGraph project Documentation Malware Analysis GitHub

T1105 · command-and-control · ATT&CK 20.0

Ingress Tool Transfer

Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as [ftp](https://attack.mitre.org/software/S0095). Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. [Lateral Tool Transfer](https://attack.mitre.org/techniques/T1570)). On Windows, adversaries may use various utilities to download tools, such as `copy`, `finger`, [certutil](https://attack.mitre.org/software/S0160), and [PowerShell](https://attack.mitre.org/techniques/T1059/001) commands such as <code>IEX(New-Object Net.WebClient).downloadString()</code> and <code>Invoke-WebRequest</code>. On Linux and macOS systems, a variety of utilities also exist, such as `curl`, `scp`, `sftp`, `tftp`, `rsync`, `finger`, and `wget`.(Citation: t1105_lolbas) A number of these tools, such as `wget`, `curl`, and `scp`, also exist on ESXi. After downloading a file, a threat actor may attempt to verify its integrity by checking its hash value (e.g., via `certutil -hashfile`).(Citation: Google Cloud Threat Intelligence COSCMICENERGY 2023) Adversaries may also abuse installers and package managers, such as `yum` or `winget`, to download tools to victim hosts. Adversaries have also abused file application features, such as the Windows `search-ms` protocol handler, to deliver malicious files to victims through remote file searches invoked by [User Execution](…

Open detection, hunting, mitigation, and evidence workspace

Detection logic

Monitor for file creation and files transferred into the network. Unusual processes with external network connections creating files on-system may be suspicious. Use of utilities, such as ftp, that does not normally occur may also be suspicious. Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Specifically, for the finger utility on Windows and Linux systems, monitor command line or terminal execution for the finger command. Monitor network activity for TCP port 79, which is used by the finger utility, and Windows netsh interface portproxy modifications to well-known ports such as 80 and 443. Furthermore, monitor file system for the download/creation and execution of suspicious files, which may indicate adversary-downloaded payloads. Analyze packet contents to detect communications that do not follow the expected protocol behavior for the port that is being used.

Observed actors

Ke3chang
G0004 APT28
G0007 Turla
G0010 Darkhotel
G0012 APT29
G0016 Molerats
G0021 APT3
G0022 APT18
G0026 Threat Group-3390
G0027 Lazarus Group
G0032 Sandworm Team
G0034 Dragonfly
G0035 Patchwork
G0040 Winnti Group
G0044 menuPass
G0045 FIN7
G0046 Gamaredon Group
G0047 OilRig
G0049 APT32
G0050 Magic Hound
G0059 BRONZE BUTLER
G0060 FIN8
G0061 APT33
G0064 Leviathan
G0065 Elderwood
G0066 APT37
G0067 PLATINUM
G0068 MuddyWater
G0069 Rancor
G0075 Gorgon Group
G0078 Cobalt Group
G0080 Tropic Trooper
G0081 APT38
G0082 APT39
G0087 WIRTE
G0090 Silence
G0091 TA505
G0092 GALLIUM
G0093 Kimsuky
G0094 APT41
G0096 APT-C-36
G0099 Wizard Spider
G0102 Rocke
G0106 Whitefly
G0107 Windshift
G0112 Chimera
G0114 Fox Kitten
G0117 Indrik Spider
G0119 Evilnum
G0120 Sidewinder
G0121 Volatile Cedar
G0123 HAFNIUM
G0125 TA551
G0127 ZIRCONIUM
G0128 Mustang Panda
G0129 Ajax Security Team
G0130 Tonto Team
G0131 Nomadic Octopus
G0133 BackdoorDiplomacy
G0135 IndigoZebra
G0136 Andariel
G0138 TeamTNT
G0139 LazyScripter
G0140 Confucius
G0142 Aquatic Panda
G0143 HEXANE
G1001 BITTER
G1002 SideCopy
G1008 Moses Staff
G1009 Metador
G1013 LuminousMoth
G1014 Scattered Spider
G1015 FIN13
G1016 Volt Typhoon
G1017 TA2541
G1018 Mustard Tempest
G1020 Cinnamon Tempest
G1021 INC Ransom
G1032 Daggerfly
G1034 Winter Vivern
G1035 Moonstone Sleet
G1036 Play
G1040 BlackByte
G1043 Salt Typhoon
G1045 Storm-1811
G1046 Medusa Group
G1051 VOID MANTICORE
G1055 TeamPCP
G1056 ShinyHunters
G1057 NIMBUS MANTICORE
G1059

Correlated CTI and IR reports

Cyber Knowledge context

Use these routes to move from the ATT&CK behavior into explanation, implementation, evidence handling, validation, and defensive operations. Relevance is generated from explicit identifiers/names and governed topic mappings; it is not attribution evidence.

Module 2 — The Intelligence Cycle Intelligence Types
Cyber Threat Intelligence (CTI) · Governed topic match · 57/100 Module 8 — Operationalizing CTI (CTI → Detection)
Cyber Threat Intelligence (CTI) · Governed topic match · 57/100 Module 6 — The Threat Actor Landscape
Cyber Threat Intelligence (CTI) · Tactic learning route · 24/100 Disassembly, decompilation, and code-led analysis
Malware Analysis & Reverse Engineering · Tactic learning route · 24/100 Module 5 — Threat hunting
Blue Team & Defensive Security · Tactic learning route · 24/100

MITRE mitigations

M1031 · Network Intrusion Prevention

Use intrusion detection signatures to block traffic at network boundaries.

MITRE mitigation source

M1037 · Filter Network Traffic

Employ network appliances and endpoint software to filter ingress, egress, and lateral network traffic. This includes protocol-based filtering, enforcing firewall rules, and blocking or restricting traffic based on predefined conditions to limit adversary movement and data exfiltration. This mitigation can be implemented through the following measures: Ingress Traffic Filtering: - Use Case: Configure network firewalls to allow traffic only from authorized IP addresses to public-facing servers. - Implementation: Limit SSH (port 22) and RDP (port 3389) traffic to specific IP ranges. Egress Traffic Filtering: - Use Case: Use firewalls or endpoint security software to block unauthorized outbound traffic to prevent data exfiltration and command-and-control (C2) communications. - Implementation: Block outbound traffic to known malicious IPs or regions where communication is unexpected. Protoc…

MITRE mitigation source

MITRE detection strategies and analytics

DET0060 · Detect Ingress Tool Transfers via Behavioral Chain

AN0165 · Analytic 0165 — Unusual or uncommon processes initiate network connections to external destinations followed by file creation (tools downloaded).
AN0166 · Analytic 0166 — Shell-based tools (curl, wget, scp) initiate connections to external domains followed by creation of executable files on disk.
AN0167 · Analytic 0167 — Process execution of curl or wget followed by a network connection and a file created in temporary or user-specific directories.
AN0168 · Analytic 0168 — Command line interface or vCLI triggers remote transfer using wget or curl, writing files into datastore paths or local tmp directories.
AN0169 · Analytic 0169 — Network device logs show anomalous inbound file transfers or uncharacteristic flows with high payload volume to network devices with storage or automation hooks.

MITRE detection source

Continue the investigation

Interactive AdversaryGraph AdversaryGraph documentation CTI Analyst Field Manual Israel Threat Actors CTI Anomaly Detection Atlas Insider Threat Detection Guide 1200km Medium research

Attack tools, simulations and detection rules

Follow explicit source relationships into the reference modules. Linked procedures and detectors are not claims of live validation or actor attribution.

T1105 Ingress Tool Transfer simulation — Exact active technique ID
T1105 detection rules — Exact active technique ID; not actor-specific detector coverage