ATT&CK technique · T1105
Ingress Tool Transfer
Command and Control· seen in 35 CISA KEV exploits
Full description, procedures and detections on attack.mitre.org
Who uses it
ATT&CK groups and malware with this technique. Highlighted: in SecurityTabs news this month.
Weaknesses that lead here
Classes of exploited vulnerability that CTID maps to this technique.
- CWE-2873 KEV CVEsImproper AuthenticationThe system doesn't properly prove who a user is, so attackers get in as someone else.
- CWE-2883 KEV CVEsAuthentication Bypass Using an Alternate Path or ChannelA second route (a debug port, an API) reaches the protected function without the login check.
- CWE-2903 KEV CVEsAuthentication Bypass by SpoofingThe system trusts something an attacker can fake, such as a source address or header.
- CWE-4163 KEV CVEsUse After FreeThe program keeps using memory after releasing it, so an attacker who controls what lands there next can hijack execution.
- CWE-5023 KEV CVEsDeserialization of Untrusted DataUntrusted bytes are turned back into live objects, which can trigger code during reconstruction.
- CWE-2842 KEV CVEsImproper Access ControlRestrictions on who can access a resource are missing or wrong.
- CWE-2852 KEV CVEsImproper AuthorizationThe system checks who you are but not whether you're allowed to do what you're asking.
- CWE-6392 KEV CVEsAuthorization Bypass Through User-Controlled KeyChanging an id in a request (an IDOR) returns another user's data.
Controls that mitigate it (8)
NIST SP 800-53 rev5, grouped by family (CTID mapping).
AC · Access Control
CA · Security Assessment and Authorization
CM · Configuration Management
SC · System and Communications Protection
SI · System and Information Integrity
Weaknesses from each CVE's CVE Record (CWE, © MITRE). Techniques: MITRE ATT&CK®. Technique ↔ control and CVE ↔ technique links: Center for Threat-Informed Defense Mappings Explorer (NIST SP 800-53 rev5; CISA KEV). Plain-language explainers are SecurityTabs editorial.