T1105 Ingress Tool Transfer

About this technique

Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp. Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer).

On Windows, adversaries may use various utilities to download tools, such as `copy`, `finger`, certutil, and PowerShell commands such as IEX(New-Object Net.WebClient).downloadString() and Invoke-WebRequest. On Linux and macOS systems, a variety of utilities also exist, such as `curl`, `scp`, `sftp`, `tftp`, `rsync`, `finger`, and `wget`. A number of these tools, such as `wget`, `curl`, and `scp`, also exist on ESXi. After downloading a file, a threat actor may attempt to verify its integrity by checking its hash value (e.g., via `certutil -hashfile`).

Adversaries may also abuse installers and package managers, such as `yum` or `winget`, to download tools to victim hosts. Adversaries have also abused file application features, such as the Windows `search-ms` protocol handler, to deliver malicious files to victims through remote file searches invoked by User Execution (typically after interacting with Phishing lures).

Files can also be transferred using various Web Services as well as native or otherwise present tools on the victim system. In some cases, adversaries may be able to leverage services that sync between a web-based and an on-premises client, such as Dropbox or OneDrive, to transfer files onto victim systems. For example, by compromising a cloud account and logging into the service's web portal, an adversary may be able to trigger an automatic syncing process that transfers the file onto the victim's machine.

Detection rules125

Rules on DetectionCode tagged with T1105.

Sigma73

Rule	Level	Log source
Pandemic Registry Key	critical	windows / registry_event
Curl Download And Execute Combination	high	windows / process_creation
File Download And Execution Via IEExec.EXE	high	windows / process_creation
File Download From IP Based URL Via CertOC.EXE	high	windows / process_creation
File Download Using Notepad++ GUP Utility	high	windows / process_creation
File Download Via Bitsadmin To A Suspicious Target Folder	high	windows / process_creation
File Download Via Windows Defender MpCmpRun.EXE	high	windows / process_creation
File Download with Headless Browser	high	windows / process_creation
File With Suspicious Extension Downloaded Via Bitsadmin	high	windows / process_creation
Finger.EXE Execution	high	windows / process_creation
Legitimate Application Writing Files In Uncommon Location	high	windows / file_event
Lolbas OneDriveStandaloneUpdater.exe Proxy Download	high	windows / registry_set
Network Communication Initiated To File Sharing Domains From Process Located In Suspicious Folder	high	windows / network_connection
Network Connection Initiated By IMEWDBLD.EXE	high	windows / network_connection
Network Connection Initiated From Process Located In Potentially Suspicious Or Uncommon Location	high	windows / network_connection
Outbound Network Connection Initiated By Script Interpreter	high	windows / network_connection
Password Protected ZIP File Opened (Suspicious Filenames)	high	windows / NULL
PowerShell DownloadFile	high	windows / process_creation
PrintBrm ZIP Creation of Extraction	high	windows / process_creation
PUA - Nimgrab Execution	high	windows / process_creation
Suspicious CertReq Command to Download	high	windows / process_creation
Suspicious Curl.EXE Download	high	windows / process_creation
Suspicious Desktopimgdownldr Command	high	windows / process_creation
Suspicious Desktopimgdownldr Target File	high	windows / file_event
Suspicious Download From File-Sharing Website Via Bitsadmin	high	windows / process_creation
Suspicious Download from Office Domain	high	windows / process_creation
Suspicious Dropbox API Usage	high	windows / network_connection
Suspicious File Created by ArcSOC.exe	high	windows / file_event
Suspicious File Downloaded From Direct IP Via Certutil.EXE	high	windows / process_creation
Suspicious File Downloaded From File-Sharing Website Via Certutil.EXE	high	windows / process_creation
Suspicious Invoke-WebRequest Execution	high	windows / process_creation
Uncommon Network Connection Initiated By Certutil.EXE	high	windows / network_connection
AppX Package Installation Attempts Via AppInstaller.EXE	medium	windows / dns_query
Arbitrary File Download Via GfxDownloadWrapper.EXE	medium	windows / process_creation
Command Line Execution with Suspicious URL and AppData Strings	medium	windows / process_creation
Download File To Potentially Suspicious Directory Via Wget	medium	linux / process_creation
Download from Suspicious Dyndns Hosts	medium	NULL / proxy
Executable from Webdav	medium	zeek / NULL
File Download From Browser Process Via Inline URL	medium	windows / process_creation
File Download Via Bitsadmin	medium	windows / process_creation
File Download via CertOC.EXE	medium	windows / process_creation
File Download Via Nscurl - MacOS	medium	macos / process_creation
Hidden Flag Set On File/Directory Via Chflags - MacOS	medium	macos / process_creation
Import LDAP Data Interchange Format File Via Ldifde.EXE	medium	windows / process_creation
Local Network Connection Initiated By Script Interpreter	medium	windows / network_connection
MsiExec Web Install	medium	windows / process_creation
Potential COM Objects Download Cradles Usage - Process Creation	medium	windows / process_creation
Potential COM Objects Download Cradles Usage - PS Script	medium	windows / ps_script
Potential DLL File Download Via PowerShell Invoke-WebRequest	medium	windows / process_creation
Potential Download/Upload Activity Using Type Command	medium	windows / process_creation
Potential In-Memory Download And Compile Of Payloads	medium	macos / process_creation
Potentially Suspicious File Creation by OpenEDR's ITSMService	medium	windows / file_event
PowerShell MSI Install via WindowsInstaller COM From Remote Location	medium	windows / process_creation
PowerShell Web Download	medium	windows / process_creation
Remote Access Tool - TacticalRMM Agent Registration to Potentially Attacker-Controlled Server	medium	windows / process_creation
Remote File Download Via Desktopimgdownldr Utility	medium	windows / process_creation
Remote File Download Via Findstr.EXE	medium	windows / process_creation
Replace.exe Usage	medium	windows / process_creation
Scheduled Task Creation with Curl and PowerShell Execution Combo	medium	windows / process_creation
Suspicious Curl File Upload - Linux	medium	linux / process_creation
Suspicious Diantz Download and Compress Into a CAB File	medium	windows / process_creation
Suspicious Download Via Certutil.EXE	medium	windows / process_creation
Suspicious Extrac32 Execution	medium	windows / process_creation
Suspicious Invoke-WebRequest Execution With DirectIP	medium	windows / process_creation
Suspicious Non-Browser Network Communication With Telegram API	medium	windows / network_connection
Wget Creating Files in Tmp Directory	medium	linux / file_event
Browser Execution In Headless Mode	low	windows / process_creation
Cisco Stage Data	low	cisco / NULL
Curl Usage on Linux	low	linux / process_creation
Insensitive Subfolder Search Via Findstr.EXE	low	windows / process_creation
PowerShell Download Via Net.WebClient - PowerShell Classic	low	windows / ps_classic_start
Remote File Copy	low	linux / NULL
Suspicious Deno File Written from Remote Source	low	windows / file_event

Splunk52

Rule	Type	Risk	Data source
Any Powershell DownloadFile	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Any Powershell DownloadString	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
BITSAdmin Download File	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
CertUtil Download With URLCache and Split Arguments	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
CertUtil Download With VerifyCtl and Split Arguments	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Cisco Isovalent - Curl Execution With Insecure Flags	Anomaly	NULL	Cisco Isovalent Process Exec
Cisco NVM - Suspicious File Download via Headless Browser	TTP	NULL	Cisco Network Visibility Module Flow Data
Cisco NVM - Webserver Download From File Sharing Website	TTP	NULL	Cisco Network Visibility Module Flow Data
Cisco Secure Firewall - Communication Over Suspicious Ports	Anomaly	NULL	Cisco Secure Firewall Threat Defense Connection Event
Cisco Secure Firewall - Connection to File Sharing Domain	Anomaly	NULL	Cisco Secure Firewall Threat Defense Connection Event
Cisco Secure Firewall - File Download Over Uncommon Port	Anomaly	NULL	Cisco Secure Firewall Threat Defense File Event
Cisco Secure Firewall - High EVE Threat Confidence	Anomaly	NULL	Cisco Secure Firewall Threat Defense Connection Event
Cisco Secure Firewall - Malware File Downloaded	Anomaly	NULL	Cisco Secure Firewall Threat Defense File Event
Cisco Secure Firewall - Repeated Malware Downloads	Anomaly	NULL	Cisco Secure Firewall Threat Defense File Event
Cisco Secure Firewall - Snort Rule Triggered Across Multiple Hosts	Anomaly	NULL	Cisco Secure Firewall Threat Defense Intrusion Event
Cisco Secure Firewall - Wget or Curl Download	Anomaly	NULL	Cisco Secure Firewall Threat Defense Connection Event
Curl Download and Bash Execution	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Curl Execution with Percent Encoded URL	Anomaly	NULL	CrowdStrike ProcessRollup2, Sysmon EventID 1, Sysmon for Linux EventID 1, Windows Event Log Security 4688
Detect Certify Command Line Arguments	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Download Files Using Telegram	TTP	NULL	Sysmon EventID 15
File Download or Read to Pipe Execution	TTP	NULL	Sysmon EventID 1, Sysmon for Linux EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Juniper Networks Remote Code Execution Exploit Detection	TTP	NULL	Suricata
Linux Curl Upload File	TTP	NULL	Sysmon for Linux EventID 1, Cisco Isovalent Process Exec
Linux Ingress Tool Transfer Hunting	Hunting	NULL	Sysmon for Linux EventID 1
Linux Ingress Tool Transfer with Curl	Anomaly	NULL	Sysmon for Linux EventID 1
Living Off The Land Detection	Correlation	NULL
Log4Shell CVE-2021-44228 Exploitation	Correlation	NULL
LOLBAS Network Connection On Uncommon Port	Anomaly	NULL	Sysmon EventID 3
LOLBAS Rare Network Connection	Anomaly	NULL	Sysmon EventID 3
LOLBAS With Network Traffic	TTP	NULL	Sysmon EventID 3
Microsoft Intune Device Health Scripts	Hunting	NULL	Azure Monitor Activity
Microsoft Intune Mobile Apps	Hunting	NULL	Azure Monitor Activity
PowerShell Script Block With URL Chain	TTP	NULL	Powershell Script Block Logging 4104
PowerShell WebRequest Using Memory Stream	TTP	NULL	Powershell Script Block Logging 4104
Suspicious Curl Network Connection	TTP	NULL	Sysmon EventID 1, Sysmon for Linux EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Wget Download and Bash Execution	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Windows Cabinet File Extraction Via Expand	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Windows CertUtil Download With URL Argument	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Windows Curl Download to Suspicious Path	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2, Cisco Network Visibility Module Flow Data
Windows Curl Upload to Remote Destination	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2, Cisco Network Visibility Module Flow Data
Windows DLL Module Loaded in Temp Dir	Hunting	NULL	Sysmon EventID 7
Windows DNS Query Request To TinyUrl	Anomaly	NULL	Sysmon EventID 22
Windows File Download Via CertUtil	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2, Cisco Network Visibility Module Flow Data
Windows File Download Via PowerShell	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2, Cisco Network Visibility Module Flow Data
Windows Ingress Tool Transfer Using Explorer	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Windows Ldifde Directory Object Behavior	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Windows Process Accessing IronLanguages Repository On GitHub	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Windows Process Execution From RDP Share	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Windows SQL Spawning CertUtil	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Windows SSH Proxy Command	Anomaly	NULL	Sysmon EventID 1, CrowdStrike ProcessRollup2
Windows Suspicious Defender Update Activity in INetCache	Anomaly	NULL	Sysmon EventID 11, Sysmon EventID 23
WinRAR Spawning Shell Application	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2

Groups88

Show 64 more

Software403

ABK Action RAT Agent Tesla Agent.btz Amadey Anchor ANDROMEDA Aria-body AshTag Astaroth AsyncRAT Attor AuditCred Avenger Azorult BabyShark BackConfig Backdoor.Oldrea BADFLICK BADHATCH BADNEWS BadPatch Bandook Bankshot

Show 379 more

Bazar BBK BeaverTail BendyBear BISCUIT Bisonal BITSAdmin BlackMould BLINDINGCAN BLUELIGHT Bonadan BONDUPDATER BoomBox BoxCaon Briba BRICKSTORM Brute Ratel C4 build_downer Bumblebee Bundlore BUSHWALK Calisto CallMe Caminho CanisterWorm Cannon Carberp Cardinal RAT CARROTBALL CARROTBAT CASTLETAP Caterpillar WebShell certutil Chaes CharmPower ChChes CHIMNEYSWEEP China Chopper CHOPSTICK Chrommme CloudDuke cmd Cobalt Strike CoinTicker Conficker CookieMiner CORESHELL CostaBricks CreepyDrive Crimson Cryptoistic CSPY Downloader Cuba Cyclops Blink Dacls DanBot DarkComet DarkGate DarkTortilla Daserf DDKONG DEATHRANSOM Denis Diavol Dipsind Disco DnsSystem DOGCALL Doki Donut down_new Downdelph DOWNIISSA DRATzarus DropBook Drovorub Dtrack DUSTTRAP Dyre Ecipekac Egregor Elise Emissary Emotet Empire esentutl EvilBunny EVILNUM Exaramel for Linux Explosive Felismus FELIXROOT Flagpro FlawedAmmyy FoggyWeb ftp FunnyDream FYAnti Gazer Gelsemium gh0st RAT GlassWorm Gold Dragon GoldenSpy GoldMax Gootloader Grandoreiro GreyEnergy GrimAgent GuLoader H1N1 Hancitor Hannotog HAPPYWORK Havoc Helminth HexEval Loader Hi-Zor HiddenFace HiddenWasp Hikit Hildegard HOPLIGHT HotCroissant HTTPBrowser HTTPTroy Hydraq HyperBro IcedID IMAPLoader Industroyer InvisibleFerret InvisiMole Ixeshe Javali JHUHUGIT JPIN jRAT JSS Loader KARAE Kasidet Kazuar Kerrdown Kessel Kevin KeyBoy KEYMARBLE KGH_SPY Kinsing Kivars Koadic KOCTOPUS KONNI Kwampirs Latrodectus LightNeuron LightSpy Linfo LiteDuke LitePower Lizar LODEINFO Lokibot LoudMiner LOWBALL Lucifer Machete MacMa macOS.OSAMiner Mafalda MagicRAT MarkiRAT MCMD MechaFlounder Melcoz metaMain Metamorfo Meteor Micropsia Milan Mini Shai-Hulud MiniDuke Mis-Type Misdat Mivast MobileOrder MoleNet Mongall More_eggs Mosquito MuddyViper NanHaiShu NanoCore NavRAT NDiskMonitor Nebulae Neo-reGeorg Neoichor Nerex Netwalker NETWIRE NICECURL Nidiran NightClub njRAT NOKKI Octopus ODAgent OilBooster OilCheck Okrum OopsIE Orz OSX_OCEANLOTUS.D OSX/Shlayer OutSteel P.A.S. Webshell P8RAT Pandora Pasam Penquin Peppy PHASEJAM PHPsert PipeMon Pisloader PLAINTEE PLEAD PlugX PoetRAT PoisonIvy PolyglotDuke Pony POSHSPY PowerDuke PowerExchange PowerLess PowerPunch POWERSOURCE POWERSTATS POWRUNER PS1 Psylo Pteranodon PUBLOAD PUNCHBUGGY Pupy PureCrypter QakBot QuasarRAT QuietSieve Raccoon Stealer RainyDay RARSTONE Raspberry Robin RATANKBA RCSession RDAT RedLeaves RedLine Stealer RegDuke reGeorg Remcos RemoteCMD RemoteUtilities Remsec Revenge RAT REvil RGDoor RIFLESPINE RogueRobin ROKRAT RTM S-Type Saint Bot Sakula SampleCheck5000 Samurai Sardonic SDBbot SeaDuke Seasalt SEASHARPEE ServHelper Seth-Locker ShadowPad Shai-Hulud Shamoon Shark SharpDisco SharpStage SHARPSTATS ShimRat ShimRatReporter SHUTTERSPEED Sibot SideTwist SILENTTRINITY Skidmap SLIGHTPULSE Sliver SLOTHFULMEDIA SLOWDRIFT Small Sieve Smoke Loader SMOKEDHAM Snip3 SocGholish SodaMaster Solar SombRAT SoreFang SpeakUp Spica SpicyOmelette SQLRat Squirrelwaffle STEADYPULSE StoneDrill StrelaStealer StrifeWater StrongPity SUNBURST SVCReady SystemBC SysUpdate Taidoor TAINTEDSCRIBE TAMECAT TDTESS TeamPCP Cloud Stealer ThiefQuest ThreatNeedle TinyTurla Tomiris TONESHELL TrickBot Trojan.Karagany TSCookie Tsundere Botnet Turian TURNEDUP TYPEFRAME UBoatRAT Unknown Logger UPPERCUT Uroburos Ursnif Valak VaporRage Vasport VBShower VERMIN VIRTUALPITA Volgmer WarzoneRAT Waterbear WEBC2 WellMail WellMess WhisperGate Wiarp Winnti for Linux Winnti for Windows WIREFIRE Woody RAT Xbash xCaon XCSSET XORIndex Loader YAHOYAH Zebrocy ZeroT Zeus Panda ZIPLINE ZLib Zox ZxShell ZxxZ

Campaigns29

Show 5 more

RedPenguin ShadowRay SharePoint ToolShell Exploitation SolarWinds Compromise Water Curupira Pikabot Distribution

Procedure examples520

Groups88

Used by	Procedure example
GroupAjax Security Team	Ajax Security Team has used Wrapper/Gholee, custom-developed malware, which downloaded additional malware to the infected system. Check Point Rocket Kitten
GroupAndariel	Andariel has downloaded additional tools and malware onto compromised hosts. AhnLab Andariel Subgroup of Lazarus June 2018
GroupAPT-C-36	APT-C-36 has downloaded binary data from a specified domain after the malicious document is opened. QiAnXin APT-C-36 Feb2019
GroupAPT18	APT18 can upload a file to the victim’s machine. PaloAlto DNS Requests May 2016
GroupAPT28	APT28 has downloaded additional files, including by using a first-stage downloader to contact the C2 server to obtain the second-stage implant. Accenture SNAKEMACKEREL Nov 2018 Bitdefender APT28 Dec 2015 Cybersecurity Advisory GRU Brute Force Campaign July 2021 TrendMicro Pawn Storm Dec 2020 Unit 42 Playbook Dec 2017
GroupAPT29	APT29 has downloaded additional tools and malware onto compromised networks. F-Secure The Dukes Mandiant APT29 Eye Spy Email Nov 22 Mandiant No Easy Breach PWC WellMess July 2020
GroupAPT3	APT3 has a tool that can copy files to remote machines. FireEye Clandestine Fox
GroupAPT32	APT32 has added JavaScript to victim websites to download additional frameworks that profile and compromise website visitors. Volexity OceanLotus Nov 2017

View all 88 groups examples

Software403

Used by	Procedure example
MalwareABK	ABK has the ability to download files from C2. Trend Micro Tick November 2019
MalwareAction RAT	Action RAT has the ability to download additional payloads onto an infected machine. MalwareBytes SideCopy Dec 2021
MalwareAgent Tesla	Agent Tesla can download additional files for execution on the victim’s machine. DigiTrust Agent Tesla Jan 2017 Talos Agent Tesla Oct 2018
MalwareAgent.btz	Agent.btz attempts to download an encrypted binary from a specified domain. ThreatExpert Agent.btz
MalwareAmadey	Amadey can download and execute files to further infect a host machine with additional malware. BlackBerry Amadey 2020
MalwareAnchor	Anchor can download additional payloads. Cyberreason Anchor December 2019 Medium Anchor DNS July 2020
MalwareANDROMEDA	ANDROMEDA can download additional payloads from C2. Mandiant Suspected Turla Campaign February 2023
MalwareAria-body	Aria-body has the ability to download additional payloads from C2. CheckPoint Naikon May 2020

View all 403 software examples

Campaigns29

Used by	Procedure example
Campaign2015 Ukraine Electric Power Attack	During the 2015 Ukraine Electric Power Attack, Sandworm Team pushed additional malicious tools onto an infected system to steal user credentials, move laterally, and destroy data. Booz Allen Hamilton
Campaign2025 Poland Wiper Attacks	During the 2025 Poland Wiper Attacks, the adversaries downloaded malicious payloads to the victim server. CERT Polska
CampaignAPT41 DUST	APT41 DUST involved execution of `certutil.exe` via web shell to download the DUSTPAN dropper. Google Cloud APT41 2024
CampaignC0010	During C0010, UNC3890 actors downloaded tools and malware onto a compromised host. Mandiant UNC3890 Aug 2022
CampaignC0015	During C0015, the threat actors downloaded additional tools and files onto a compromised network. DFIR Conti Bazar Nov 2021
CampaignC0017	During C0017, APT41 downloaded malicious payloads onto compromised systems. Mandiant APT41
CampaignC0018	During C0018, the threat actors downloaded additional tools, such as Mimikatz and Sliver, as well as Cobalt Strike and AvosLocker ransomware onto the victim network. Cisco Talos Avos Jun 2022 Costa AvosLocker May 2022
CampaignC0021	During C0021, the threat actors downloaded additional tools and files onto victim machines. FireEye APT29 Nov 2018 Microsoft Unidentified Dec 2018

View all 29 campaigns examples

References5

Dropbox Malware Sync Open source
David Talbot. (2013, August 21). Dropbox and Similar Services Can Sync Malware. Retrieved May 31, 2023.
Google Cloud Threat Intelligence COSCMICENERGY 2023 Open source
COSMICENERGY: New OT Malware Possibly Related To Russian Emergency Response Exercises. (2023, May 25). Ken Proska, Daniel Kapellmann Zafra, Keith Lunden, Corey Hildebrandt, Rushikesh Nandedkar, Nathan Brubaker. Retrieved March 18, 2025.
PTSecurity Cobalt Dec 2016 Open source
Positive Technologies. (2016, December 16). Cobalt Snatch. Retrieved October 9, 2018.
T1105: Trellix_search-ms Open source
Mathanraj Thangaraju, Sijo Jacob. (2023, July 26). Beyond File Search: A Novel Method for Exploiting the "search-ms" URI Protocol Handler. Retrieved March 15, 2024.
t1105_lolbas Open source
LOLBAS. (n.d.). LOLBAS Mapped to T1105. Retrieved March 11, 2022.