Upload Tool (T1608.002) is a Resource Development sub-technique under Stage Capabilities, with PRE as its platform. The adversary uploads tools to third-party or adversary-controlled infrastructure so they are available later during an intrusion.
The difference from Upload Malware is intent. MITRE says tools can be open or closed source, free or commercial, and were not built for malicious purposes, unlike malware. PsExec is the example given on the page. That is what makes this one awkward: the file itself may be perfectly legal software.
How attackers use it
A tool is placed on an internet-accessible web server so a victim network can fetch it, enabling Ingress Tool Transfer. It may sit on infrastructure the adversary bought or rented, on compromised infrastructure, or on web services such as an adversary-controlled GitHub repository or a Platform-as-a-Service offering.
MITRE adds a twist. An adversary can skip the upload completely by having compromised machines download the tool from a third-party location, including a repository the adversary does not control or the tool's original hosting site.
Examples listed on the page:
- During the 2025 Poland Wiper Attacks, adversaries staged tools and files on Dropbox and Pastebin.
- Medusa Group used a file hosting service to host a zip file containing a remote monitoring and management service such as ConnectWise.
- Threat Group-3390 staged tools including gsecdump and WCE on previously compromised websites.
- Lazarus Group used multiple servers to host malicious tools during Operation Dream Job.
How to detect it
MITRE's detection note says internet scanning may find staged tools if infrastructure or tooling patterns were already identified, but that most of this happens outside your view. It suggests focusing on later phases such as Ingress Tool Transfer.
That points to a few useful controls:
- Inventory your own admin tools. If you know which remote management and remote execution tools are approved, an unapproved one stands out immediately.
- Watch for first-time downloads of dual-use tools from file sharing sites, paste services and code hosts.
- Alert on new remote management agents installing themselves on servers or workstations where nobody requested one.
- Look at parent processes. A browser or document reader spawning an installer for a management tool is unusual.
How to reduce the risk
Per MITRE, the upload cannot easily be mitigated with preventive controls, since it takes place outside enterprise defenses. Reduce the damage downstream:
- Use application control so only approved tools run, including approved remote management tools.
- Restrict outbound access from servers to the internet, so a compromised host cannot simply fetch a tool.
- Limit local administrator rights, since most dual-use tools need them.
- Log process creation with command lines on endpoints so a first-time tool run is visible.
Check your own environment
- Write down the list of remote administration tools you actually approve. Compare it against what is installed.
- On Windows, check process creation logging: Security Event ID 4688 with command line capture, or Sysmon Event ID 1.
- Review which servers have unrestricted outbound internet access, and ask whether each needs it.
- Search proxy logs for downloads from paste and file sharing sites by server systems.
Quick check
How is a tool different from malware in MITRE's terms?
A tool, such as PsExec, was not intended for malicious use, whereas malware was. The tool can still serve an adversary during an intrusion.
Can an adversary avoid uploading a tool at all?
Yes. They can have a compromised machine download it straight from a third-party host, including the tool's original hosting site.
