File transfer utility opening an outbound connection

Siemphony@siemphonylowT1105unverified

MITRE's analytic opens with an uncommon process making an external connection and ends with a tool appearing on disk. The network-connection event is the one log source in the strategy that names the process and the destination together, so this rule matches the first step: an outbound connection initiated by one of the transfer utilities the technique text names — finger, certutil, curl and tftp — plus ftp.exe and the OpenSSH client, which are the author's addition rather than MITRE's. Sysmon EventID 3 names the process that owns the socket, which rules several canonical downloaders out of this log source entirely: bitsadmin.exe only queues a job that the BITS service performs later from inside svchost.exe, and scp.exe and sftp.exe hand the transport to ssh.exe, so ssh.exe is the image listed here and the other three would never match. Catching those needs a separate process_creation rule on the command line (bitsadmin with /transfer or /addfile). wget.exe is kept although Windows does not ship it — on Windows `wget` is a PowerShell alias for Invoke-WebRequest, which runs inside powershell.exe, so a real wget.exe image means somebody brought the binary, which is itself the signal. Interpreted downloaders are deliberately absent: matching powershell.exe or a browser here would fire on every host continuously, and the file-creation half of the chain is a timed correlation Sigma cannot express, so a hit is a download attempt and not evidence that anything landed. Two limitations to state plainly. The image name is the whole detection and Sysmon EventID 3 carries no OriginalFileName, so copying curl.exe to another filename defeats the rule outright; pair it with a process_creation companion keyed on OriginalFileName, which survives a rename (curl.exe ships as `curl.exe`, certutil as `CertUtil.exe`). And Sigma has no CIDR operator, so a fetch from an internal artefact mirror alerts exactly like a fetch from the internet — MITRE's DestinationIPCategory knob has to be implemented as a backend-side address filter after translation. Sysmon EventID 3 is also frequently disabled or narrowly filtered in shipped configurations, and where it is, this rule returns nothing regardless of what ran. UNVERIFIED — derived from MITRE ATT&CK DET0060 and never executed against logs.Full description

The 2 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Splunk · SPL

Run this as a search.

index=* ((Image="*\\certutil.exe" OR Image="*\\finger.exe" OR Image="*\\tftp.exe" OR Image="*\\curl.exe" OR Image="*\\wget.exe" OR Image="*\\ftp.exe" OR Image="*\\ssh.exe") AND Initiated="true")

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,network_connection,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)(\\certutil\.exe$|\\finger\.exe$|\\tftp\.exe$|\\curl\.exe$|\\wget\.exe$|\\ftp\.exe$|\\ssh\.exe$)</field>    <field name="Initiated" type="pcre2">(?i)^true$</field>    <description>File transfer utility opening an outbound connection</description>    <mitre>      <id>T1105</id>    </mitre>  </rule></group>

Sentinel · KQL

Run this as a search.

Sentinel cannot express this construct. `Initiated` has no Sentinel column: Defender expresses connection direction in `ActionType`, not as a boolean column, so `Initiated` cannot be renamed — it needs a different predicate. The Sigma source is on the first tab, unchanged.

Elastic · ES|QL

Run this as a search.

Elastic cannot express this construct. `Initiated` has no ECS field: ECS expresses connection direction as `network.direction` with values like `egress`, not as a boolean, so `Initiated` needs a different predicate rather than a rename. The Sigma source is on the first tab, unchanged.

At a glance

Logsource: network_connection / windows
Level: low
Category: ingress_tool_transfer
Sigma status: experimental
Backends: 2 of 4 rendered
Updated: 3 Sept 2026
Rule ID: 6e146297-c0bd-4937-8b8c-dd2b481035bc

ATT&CKT1105

T1105Ingress Tool Transfer

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessoningress tool transfer

ingress tool transfer

01 · What this rule detects

An adversary moving tooling onto a host they have just reached — a transfer utility the operating system already ships opening an outbound connection, the background transfer service being handed a job from the command line, or a shell one-liner that downloads a payload, marks it executable and runs it in a single breath.

02 · Telemetry you need

Process creation with full command lines on both Windows and Linux — the download command's own text is most of the signal
Network connection events that name the initiating process (Sysmon Event ID 3 or equivalent), because the process owning the socket is what separates certutil-as-downloader from certutil validating a certificate chain
Parent process and user context, to tell an interactive administrator from a service account or a web server's child
On Linux, execve auditing that captures the full inline -c script of a shell, not just its first argument

03 · How the logic works

Three shapes, in rising order of intent. First, a known transfer utility — certutil, curl, wget, tftp, finger, ftp, ssh — initiating an outbound connection: the network-connection event is the one log source where the process and the destination arrive together. Second, the background transfer service being scripted: bitsadmin carrying /transfer, /addfile or /SetNotifyCmdLine, or the BITS PowerShell cmdlets — which both stages the payload and, through the notify command, can run it later under a service identity. Third, on Linux, the compressed stager: one shell invocation that fetches into /tmp or /var/tmp and chmods the result on the same command line, or that sleeps before piping a download straight into an interpreter. The shapes matter more than the tool names — a downloader you have never heard of still has to touch a world-writable path, mark something executable, or wire a fetch to an interpreter.

04 · Common false positives

curl.exe ships with Windows and is the default fetch in build scripts, health checks and monitoring probes — on any estate it is the highest-volume match and is not separable on the network event alone
Software distribution and patching that still stages packages with bitsadmin /transfer or Start-BitsTransfer, from a configuration-management parent on a fixed schedule
Provisioners, CI runners and container entrypoints that legitimately download a binary to /tmp, chmod +x it and execute it — the same idiom as the malicious stager, differing only in the URL and the payload
certutil retrieving a certificate revocation list or issuer certificate during ordinary chain validation

05 · Detection maturity

Tier 1 — starting point: Matches the named transfer utilities and BITS switches in command lines, fleet-wide, with no exclusions.
Tier 2 — tuned: Scopes by parent process and account, separates fixed-cadence automation from interactive use, and raises severity on fetch-and-execute one-liners into world-writable paths.
Tier 3 — correlated: Correlates the download with the file write and the subsequent execution into one incident, and enriches with whether the destination has ever been seen from that host.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Key exclusions on the parent process or service account together with the utility, never the utility alone — excluding curl outright blinds the rule to the most common ingress path
Raise severity when the same command line both fetches and executes, and when the write path is /tmp, /var/tmp or a user-writable Windows directory
Give bitsadmin /SetNotifyCmdLine its own higher-severity rule: a transfer job that runs a command afterwards is persistence wearing an ingress coat
Fixed-cadence matches are automation — baseline them by host and command line before enabling alerts, and treat a first-seen destination as worth more than a first-seen tool

Declared by the author

Administrator and build automation that fetches artefacts with curl.exe, which now ships in Windows and is the default choice in most scripts and container images. This is the highest-volume match by a wide margin and it is not separable on this event alone; the parent process is where MITRE's ParentProcessName knob is aimed, and here it has to be applied downstream because a network-connection event carries no parent.
Monitoring and observability agents that shell out to curl.exe on every polling interval — Zabbix, Nagios and Datadog HTTP checks, container and IIS healthchecks — producing a continuous fleet-wide baseline of matching connections at a fixed cadence.
Interactive administration of servers and network appliances over the OpenSSH client, ftp or tftp, including firmware pushes and scheduled configuration backups. ssh.exe cannot be told apart from scp or sftp on this event, so every interactive SSH session matches as readily as a file transfer.
certutil.exe retrieving a certificate revocation list or an issuer certificate during ordinary chain validation, and legacy installers and software-distribution agents that still stage payloads over ftp.

Noise check0 of 2 fired

Fires on none of the 2 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 2 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification2 runs

Not verified

Security Datasets — Ingress tool transfer
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.
Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1105, evaluated against their network_connection events.

Share this rule

/u/siemphony/6e146297-c0bd-4937-8b8c-dd2b481035bc

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

File transfer utility opening an outbound connection

The detection

detection.yml

Splunk · SPL

Wazuh · XML rule

Sentinel · KQL

Elastic · ES|QL

Community

Verdicts from engineers who deployed it