T1105 Ingress Tool Transfer

3 threats tracked by Spectrum Delta use this technique.

T1105 on MITRE ATT&CK →

• Prince of Persia / Infy

  Staged escalation: Foudre downloads and launches Tonnerre

  Proxy: a second-stage binary fetch (the primary does not name the specific download destination for the Tonnerre transfer); endpoint: Sysmon Event ID 1 process-create records showing a new binary executing after a C2 fetch — the transfer is identified by correlating the two records, since neither alone identifies it as Tonnerre; the Foudre profiling behaviors are malware capability described by the primary, not events the named telemetry records

  Seen in: Enterprise web proxy, Endpoint process telemetry

• Amazon ClickFix (Doina)

  finger.exe LOLBin retrieves a staged .plan script over Finger (79/tcp)

  Windows process-creation events with command lines: finger.exe with a remote user@host argument; network-flow records for outbound 79/tcp to grillrecipespro[.]com. How the command was invoked (Run dialog, clipboard pastejacking) comes from Huntress's investigation, not from ordinary process events. Plaintext Finger content can be observed with packet capture or protocol inspection; flow records alone cannot show .plan contents. Egress 79/tcp is independently notable because finger.exe is rare on workstations (the Sigma rule acknowledges administrative false positives)

  Seen in: Windows process-creation events, Network flow telemetry

• LiteLLM 1.107.0 backdoor

  sitecustomize.py detached remote-code loader with GitHub dead-drop pointer

  auditd file events for /tmp/remote_code_loader.lock; process events for detached Python; proxy/DNS for the dead-drop URL and any /codepy fetch

  Seen in: Linux auditd, Microsoft Defender for Endpoint / Sysmon, Web proxy / DNS logs