Ingress Tool Transfer

This course gives cybersecurity professionals an in-depth understanding of the MITRE TTP T1105 technique. This involves using legitimate tools to transfer malicious files onto a target network and the techniques used to evade detection. The course will also cover prevention strategies for this type of attack.

Course Content

Magic Hound Lab


Magic Hound Lab
Attack, Detect and Mitigate


What is Technique T1056.001?
Attack, Detect and Mitigate


What is Sub-Technique T1056.001?
Course Description

This course will cover the technique:

1. [T1105]( Ingress Tool Transfer is used by MITRE to describe a type of cyber attack where an attacker gains access to a victim's network by transferring an external tool or software into the victim's environment. This external tool can be any software or application that an attacker uses to gain unauthorized access to the victim's network.

2. [T1056.001]( Input Capture: Keylogging involves using software or hardware to record the keystrokes entered on a keyboard. Adversaries can use this technique to capture sensitive information, such as passwords or credit card numbers, which can then be used to gain unauthorized access to a computer system or network.

> Learn how to detect and mitigate these techniques to protect your organization from this type of attack. Apply what you learn and get the hands-on skills you need in Cybrary's MITRE ATT&CK Framework courses aligned to tactics and techniques used by threat actors.

This course is part of a Career Path:
No items found.

Instructed by

Owen Dubiel

Owen is certified in the GIAC GSEC, CompTIA CySA+, and various other vendor-related certifications. He works both as a technical security engineer and as an SME architect instructor in his spare time. Spreading the word of cyber security is a passion of his. Owen lives in Southeast Michigan with his beautiful wife, daughter, and his dog, Thor. In his free time, Owen enjoys watching sports and movies, and spending time with his family.

Lucas Romano

Lucas is a seasoned threat researcher in multiple security disciplines, such as real-world adversarial tracking, network vulnerabilities, web exploitation, API abuse, and more. He began his career at the US Department of Defense, where he was trained by some of the world's best operators and analysts. Lucas now operates in the Cybrary red team, emulating real-world threat actors and running purple team exercises. He has 11 industry certifications, including the OSWA, GPEN, GAWN, GCFE, and RHCSA. He is also a member of the GIAC Advisory Board. In his free time, he enjoys working outdoors to improve his farm.

Cybrary Logo
Certification Body
Certificate of Completion

Complete this entire course to earn a Ingress Tool Transfer Certificate of Completion