Ingress Tool Transfer
Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as [ftp](https://attack.mitre.org/software/S0095). Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. [Lateral Tool Transfer](https://attack.mitre.org/techniq...
BY SOURCE
PROCEDURES (80)
Auto-extracted: 17 detections for download
Auto-extracted: 12 detections for suspicious
Auto-extracted: 9 detections for remote
Auto-extracted: 7 detections for download
Auto-extracted: 6 detections for process creation monitoring
Auto-extracted: 5 detections for powershell
Auto-extracted: 5 detections for remote
Auto-extracted: 4 detections for suspicious
Auto-extracted: 4 detections for remote
Auto-extracted: 3 detections for http
Auto-extracted: 3 detections for dump
Auto-extracted: 3 detections for lateral
Auto-extracted: 2 detections for lateral
Auto-extracted: 2 detections for dns
Auto-extracted: 2 detections for command and control
Auto-extracted: 2 detections for privilege
Auto-extracted: 2 detections for bypass
Auto-extracted: 2 detections for tunnel
Auto-extracted: 2 detections for credential
Auto-extracted: 2 detections for download
Auto-extracted: 2 detections for general monitoring
Auto-extracted: 2 detections for command and control
Auto-extracted: 2 detections for privilege
Auto-extracted: 2 detections for api
Auto-extracted: 2 detections for http
Auto-extracted: 2 detections for container
Auto-extracted: 2 detections for service
Auto-extracted: 2 detections for container
Auto-extracted: 2 detections for http
Auto-extracted: 2 detections for suspicious
Auto-extracted: 2 detections for exfiltrat
Auto-extracted: 2 detections for email
Auto-extracted: 2 detections for script block
Auto-extracted: 2 detections for persist
Auto-extracted: 2 detections for aws
Auto-extracted: 2 detections for api
Auto-extracted: 1 detections for download
Auto-extracted: 1 detections for evasion
Auto-extracted: 1 detections for http
Auto-extracted: 1 detections for inject
Auto-extracted: 1 detections for ransomware
Auto-extracted: 1 detections for aws
Auto-extracted: 1 detections for persist
Auto-extracted: 1 detections for aws
Auto-extracted: 1 detections for suspicious
Auto-extracted: 1 detections for lateral
Auto-extracted: 1 detections for cloud monitoring
Auto-extracted: 1 detections for network connection monitoring
Auto-extracted: 1 detections for exfiltrat
Auto-extracted: 1 detections for suspicious
Auto-extracted: 1 detections for container
Auto-extracted: 1 detections for powershell
Auto-extracted: 1 detections for parent process
Auto-extracted: 1 detections for exfiltrat
Auto-extracted: 1 detections for remote
Auto-extracted: 1 detections for parent process
Auto-extracted: 1 detections for bypass
Auto-extracted: 1 detections for suspicious
Auto-extracted: 1 detections for encrypt
Auto-extracted: 1 detections for privilege
Auto-extracted: 1 detections for child process
Auto-extracted: 1 detections for ransomware
Auto-extracted: 1 detections for bypass
Auto-extracted: 1 detections for http
Auto-extracted: 1 detections for email
Auto-extracted: 1 detections for child process
Auto-extracted: 1 detections for unusual
Auto-extracted: 1 detections for phish
Auto-extracted: 1 detections for obfuscat
Auto-extracted: 1 detections for persist
Auto-extracted: 1 detections for persist
Auto-extracted: 1 detections for child process
Auto-extracted: 1 detections for inject
Auto-extracted: 1 detections for powershell
Auto-extracted: 1 detections for evasion
Auto-extracted: 1 detections for dump
Auto-extracted: 1 detections for suspicious
Auto-extracted: 1 detections for http
Auto-extracted: 1 detections for inject
Auto-extracted: 1 detections for service