T1105Command and Control
Ingress Tool Transfer
Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp. Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment…
CVEs47
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.45
Reports1
Detections
87 Sigma rules tagged T1105Ingress Tool TransferT110587 general rules
- Greenbug Espionage Group Indicatorscriticaltest
- Pandemic Registry Keycriticaltest
- Curl Download And Execute Combinationhightest
- File Download And Execution Via IEExec.EXEhightest
- File Download From IP Based URL Via CertOC.EXEhightest
- File Download Using Notepad++ GUP Utilityhightest
- File Download Via Bitsadmin To A Suspicious Target Folderhightest
- File Download Via Windows Defender MpCmpRun.EXEhightest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Ingress Tool Transfer
47 CVEs, by priority. Each link shows its badge.- CVE-2023-3519Citrix NetScaler ADC and NetScaler Gateway Code Injection VulnerabilityCitrix · NetScaler ADC and NetScaler GatewayKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1574Hijack Execution Flow+2 more · 6 reportsMITRE CTID mapping of the KEV entry · primary impact99.7%Top 0.05%89.9priority
- CVE-2022-30190Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution VulnerabilityMicrosoft · WindowsKEVRansomwarePublic exploitHigh · 7.8T1204.002Malicious FileT1105Ingress Tool Transfer4 reportsMITRE CTID mapping of the KEV entry · primary impact99.2%Top 0.07%87.4priority
- CVE-2023-34362Progress MOVEit Transfer SQL Injection VulnerabilityProgress · MOVEit TransferKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter+5 more · 2 reportsMITRE CTID mapping of the KEV entry · follow-on activity99.9%Top 0.03%86.0priority
- CVE-2010-0188Adobe Reader and Acrobat Arbitrary Code Execution VulnerabilityAdobe · Reader and AcrobatKEVRansomwarePublic exploitHigh · 7.8T1189Drive-by CompromiseT1105Ingress Tool Transfer2 reportsMITRE CTID mapping of the KEV entry · primary impact88.2%Top 0.23%84.5priority
- CVE-2023-48788Fortinet FortiClient EMS SQL Injection VulnerabilityFortinet · FortiClient EMSKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter+1 more · 1 reportMITRE CTID mapping of the KEV entry · follow-on activity98.4%Top 0.08%83.7priority
- CVE-2016-1019Adobe Flash Player Arbitrary Code Execution VulnerabilityAdobe · Flash PlayerKEVRansomwareCritical · 9.8T1105Ingress Tool TransferT1486Data Encrypted for Impact4 reportsMITRE CTID mapping of the KEV entry · primary impact22.3%Top 2.3%83.4priority
- CVE-2023-38831RARLAB WinRAR Code Execution VulnerabilityRARLAB · WinRARKEVRansomwarePublic exploitHigh · 7.8T1204User ExecutionT1053Scheduled Task/Job+5 more · 1 reportMITRE CTID mapping of the KEV entry · follow-on activity99.8%Top 0.04%82.3priority
- CVE-2015-8651Adobe Flash Player Integer Overflow VulnerabilityAdobe · Flash PlayerKEVHigh · 8.8T1189Drive-by CompromiseT1105Ingress Tool Transfer+1 more · 3 reportsMITRE CTID mapping of the KEV entry · primary impact67.7%Top 0.69%81.8priority
- CVE-2010-2861Adobe ColdFusion Directory Traversal VulnerabilityAdobe · ColdFusionKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1119Automated Collection+1 moreMITRE CTID mapping of the KEV entry · primary impact99.7%Top 0.05%79.9priority
- CVE-2023-22518Atlassian Confluence Data Center and Server Improper Authorization VulnerabilityAtlassian · Confluence Data Center and ServerKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1033System Owner/User Discovery+1 moreMITRE CTID mapping of the KEV entry · follow-on activity>99.9%Top 0.01%79.9priority
- CVE-2023-27350PaperCut MF/NG Improper Access Control VulnerabilityPaperCut · MF/NGKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter+1 moreMITRE CTID mapping of the KEV entry · follow-on activity>99.9%Top 0.01%79.9priority
- CVE-2023-29300Adobe ColdFusion Deserialization of Untrusted Data VulnerabilityAdobe · ColdFusionKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1105Ingress Tool TransferMITRE CTID mapping of the KEV entry · primary impact>99.9%Top 0.01%79.9priority
- CVE-2023-38035Ivanti Sentry Authentication Bypass VulnerabilityIvanti · SentryKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter+6 moreMITRE CTID mapping of the KEV entry · follow-on activity>99.9%Top 0.03%79.9priority
- CVE-2022-26352dotCMS Unrestricted Upload of File VulnerabilitydotCMS · dotCMSKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1105Ingress Tool TransferAI mapping from the description · primary impact91.2%Top 0.19%79.8priority
- CVE-2023-38203Adobe ColdFusion Deserialization of Untrusted Data VulnerabilityAdobe · ColdFusionKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1105Ingress Tool TransferMITRE CTID mapping of the KEV entry · primary impact97.1%Top 0.11%79.8priority
- CVE-2024-23692Rejetto HTTP File Server Improper Neutralization of Special Elements Used in a Template Engine VulnerabilityRejetto · HTTP File ServerKEVRansomwarePublic exploitCritical · 9.8T1082System Information DiscoveryT1005Data from Local System+2 moreMITRE CTID mapping of the KEV entry · follow-on activity99.5%Top 0.06%79.8priority
- CVE-2011-0611Adobe Flash Player Remote Code Execution VulnerabilityAdobe · Flash PlayerKEVPublic exploitHigh · 8.8T1204.002Malicious FileT1105Ingress Tool Transfer3 reportsMITRE CTID mapping of the KEV entry · primary impact99.4%Top 0.06%76.9priority
- CVE-2026-76519Cisco Secure Email Gateway Relative Path Traversal VulnerabilityCisco · Secure Email GatewayKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter+1 moreAI mapping from the description · primary impact2.2%Top 18%76.3priority
- CVE-2023-20867VMware Tools Authentication Bypass VulnerabilityVMware · ToolsKEVLow · 3.9T1078Valid AccountsT1059Command and Scripting Interpreter+1 more · 2 reportsMITRE CTID mapping of the KEV entry · follow-on activity13.6%Top 3.5%76.2priority
- CVE-2015-5119Adobe Flash Player Use-After-Free VulnerabilityAdobe · Flash PlayerKEVPublic exploitEnd of lifeCritical · 9.8T1566.002Spearphishing LinkT1059.007JavaScript+3 more · 5 reportsMITRE CTID mapping of the KEV entry · primary impact98.6%Top 0.08%74.8priority
- CVE-2026-20230Cisco Unified Communications Manager Server-Side Request Forgery (SSRF) VulnerabilityCisco · Unified Communications ManagerKEVPublic exploitHigh · 8.6T1190Exploit Public-Facing ApplicationT1105Ingress Tool TransferAI mapping from the description · primary impact88.5%Top 0.23%74.0priority
- CVE-2016-4117Adobe Flash Player Arbitrary Code Execution VulnerabilityAdobe · Flash PlayerKEVRansomwarePublic exploitEnd of lifeCritical · 9.8T1105Ingress Tool Transfer3 reportsMITRE CTID mapping of the KEV entry · primary impact94.3%Top 0.15%72.6priority
- CVE-2021-20022SonicWall Email Security Unrestricted Upload of File VulnerabilitySonicWall · SonicWall Email SecurityKEVRansomwareHigh · 7.2T1078Valid AccountsT1105Ingress Tool TransferAI mapping from the description · primary impact16.6%Top 3%72.4priority
- CVE-2010-1297Adobe Flash Player Memory Corruption VulnerabilityAdobe · Flash PlayerKEVPublic exploitHigh · 7.8T1189Drive-by CompromiseT1204.002Malicious File+1 more · 1 reportMITRE CTID mapping of the KEV entry · primary impact82.5%Top 0.34%72.3priority
- CVE-2024-11667Zyxel Multiple Firewalls Path Traversal VulnerabilityZyxel · Multiple FirewallsKEVRansomwareCritical · 9.8T1190Exploit Public-Facing ApplicationT1005Data from Local System+1 moreAI mapping from the description · primary impact2.9%Top 13%72.3priority
- CVE-2021-35394Realtek Jungle SDK Remote Code Execution VulnerabilityRealtek · Jungle Software Development Kit (SDK)KEVPublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter+5 moreMITRE CTID mapping of the KEV entry · follow-on activity99.9%Top 0.04%69.9priority
- CVE-2021-44515Zoho Desktop Central Authentication Bypass VulnerabilityZoho · Desktop CentralKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1003OS Credential Dumping+3 moreMITRE CTID mapping of the KEV entry · primary impact99.9%Top 0.04%69.9priority
- CVE-2017-11317Telerik UI for ASP.NET AJAX Unrestricted File Upload VulnerabilityTelerik · User Interface (UI) for ASP.NET AJAXKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter+1 moreAI mapping from the description · primary impact84.2%Top 0.3%69.8priority
- CVE-2023-2868Barracuda Networks ESG Appliance Improper Input Validation VulnerabilityBarracuda Networks · Email Security Gateway (ESG) ApplianceKEVPublic exploitCritical · 9.8T1566.001Spearphishing AttachmentT1059Command and Scripting Interpreter+2 moreMITRE CTID mapping of the KEV entry · follow-on activity86.8%Top 0.26%69.8priority
- CVE-2024-7399Samsung MagicINFO 9 Server Path Traversal VulnerabilitySamsung · MagicINFO 9 ServerKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1105Ingress Tool TransferAI mapping from the description · primary impact91.9%Top 0.18%69.8priority
- CVE-2025-31200Apple Multiple Products Memory Corruption VulnerabilityApple · Multiple ProductsKEVPublic exploitCritical · 9.8T1059Command and Scripting InterpreterT1106Native API+3 moreMITRE CTID mapping of the KEV entry · primary impact20.9%Top 2.4%69.4priority
- CVE-2025-31201Apple Multiple Products Arbitrary Read and Write VulnerabilityApple · Multiple ProductsKEVPublic exploitCritical · 9.8T1059Command and Scripting InterpreterT1106Native API+3 moreMITRE CTID mapping of the KEV entry · primary impact14.0%Top 3.5%69.2priority
- CVE-2016-0984Adobe Flash Player and AIR Use-After-Free VulnerabilityAdobe · Flash Player and AIRKEVPublic exploitHigh · 8.8T1204.002Malicious FileT1105Ingress Tool TransferMITRE CTID mapping of the KEV entry · primary impact54.5%Top 0.99%69.0priority
- CVE-2023-26360Adobe ColdFusion Deserialization of Untrusted Data VulnerabilityAdobe · ColdFusionKEVPublic exploitHigh · 8.6T1190Exploit Public-Facing ApplicationT1059.007JavaScript+7 moreMITRE CTID mapping of the KEV entry · follow-on activity97.3%Top 0.1%69.0priority
- CVE-2024-4978Justice AV Solutions (JAVS) Viewer Installer Embedded Malicious Code VulnerabilityJustice AV Solutions · Viewer KEVPublic exploitHigh · 8.4T1195.002Compromise Software Supply ChainT1005Data from Local System+2 moreMITRE CTID mapping of the KEV entry · primary impact26.9%Top 2%68.5priority
- CVE-2023-7101Spreadsheet::ParseExcel Remote Code Execution VulnerabilitySpreadsheet::ParseExcel · Spreadsheet::ParseExcelKEVPublic exploitHigh · 7.8T1059Command and Scripting InterpreterT1105Ingress Tool TransferMITRE CTID mapping of the KEV entry · follow-on activity19.0%Top 2.7%67.9priority
- CVE-2026-84869ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization VulnerabilityConnectWise · ScreenConnectKEVCritical · 9.9T1078Valid AccountsT1059Command and Scripting Interpreter+1 moreAI mapping from the description · primary impact0.9%Top 40%67.0priority
- CVE-2025-55177Meta Platforms WhatsApp Incorrect Authorization VulnerabilityMeta Platforms · WhatsAppKEVPublic exploitMedium · 5.4T1190Exploit Public-Facing ApplicationT1105Ingress Tool TransferAI mapping from the description · primary impact13.5%Top 3.6%66.1priority
- CVE-2018-15982Adobe Flash Player Use-After-Free VulnerabilityAdobe · Flash PlayerKEVRansomwarePublic exploitEnd of lifeHigh · 7.8T1204.002Malicious FileT1105Ingress Tool TransferMITRE CTID mapping of the KEV entry · primary impact89.6%Top 0.21%63.4priority
- CVE-2025-43200Apple Multiple Products Unspecified VulnerabilityApple · Multiple ProductsKEVMedium · 4.2T1203Exploitation for Client ExecutionT1005Data from Local System+1 moreMITRE CTID mapping of the KEV entry · primary impact1.2%Top 32%54.5priority
- CVE-2012-0754Adobe Flash Player Memory Corruption VulnerabilityMITRE CTID mapping of the KEV entry · primary impact91.1%Top 0.19%53.6priority
- CVE-2012-1535Adobe Flash Player Arbitrary Code Execution VulnerabilityAdobe · Flash PlayerKEVPublic exploitEnd of lifeHigh · 7.8T1204.002Malicious FileT1105Ingress Tool TransferMITRE CTID mapping of the KEV entry · primary impact70.4%Top 0.61%53.3priority
- CVE-2013-0641Adobe Reader Buffer Overflow VulnerabilityAdobe · ReaderKEVEnd of lifeHigh · 7.8T1204.002Malicious FileT1105Ingress Tool Transfer+1 more · 1 reportMITRE CTID mapping of the KEV entry · primary impact32.3%Top 1.7%52.0priority
- CVE-2017-11292Adobe Flash Player Type Confusion VulnerabilityAdobe · Flash PlayerKEVEnd of lifeHigh · 8.8T1566.001Spearphishing AttachmentT1204.002Malicious File+2 moreMITRE CTID mapping of the KEV entry · primary impact11.9%Top 3.9%48.4priority
- CVE-2026-118527Ivanti Connect Secure Generation of Predictable Numbers or Identifiers VulnerabilityAI mapping from the description · primary impactNo EPSS45.0priority
- CVE-2019-1620Cisco Data Center Network Manager Arbitrary File Upload and Remote Code Execution VulnerabilityCisco · Cisco Data Center Network ManagerPublic exploitCritical · 9.8T1059Command and Scripting InterpreterT1105Ingress Tool TransferMITRE CTID mapping of the CVE · primary impact83.8%Top 0.31%32.5priority
- CVE-2019-1689Cisco Webex Teams for iOS Arbitrary File Upload VulnerabilityMITRE CTID mapping of the CVE · primary impact1.6%Top 25%20.2priority