Persistence via BITS SetNotifyCmdLine Method

[rule]
description = """
Identifies suspicious execution from the Windows Background Intelligent Transfer Service (BITS) service via BITS
SetNotifyCmdLine method. This method specifies a program to execute when a BITS job enters the BG_JOB_STATE_ERROR or
BG_JOB_STATE_TRANSFERRED state. This feature can be abused to maintain stealthy persistence on an infected system.
"""
id = "3400fac0-3978-4cc5-a82d-69d08625c3ad"
license = "Elastic License v2"
name = "Persistence via BITS SetNotifyCmdLine Method"
os_list = ["windows"]
reference = [
    "https://blog.menasec.net/2021/05/hunting-for-suspicious-usage-of.html",
    "https://docs.microsoft.com/en-us/windows/win32/api/bits1_5/nf-bits1_5-ibackgroundcopyjob2-setnotifycmdline",
    "https://www.elastic.co/security-labs/bits-and-bytes-analyzing-bitsloth",
]
version = "1.0.30"

query = '''
process where event.action == "start" and

 /* child process of the BITS service */
 process.parent.name == "svchost.exe" and process.parent.args == "BITS" and

 (
  /* commonly abused trusted programs */
  process.pe.original_file_name in ("cscript.exe", "wscript.exe", "PowerShell.EXE", "Cmd.Exe", "MSHTA.EXE", "RUNDLL32.EXE",
  "REGSVR32.EXE", "MSBuild.exe", "InstallUtil.exe", "RegAsm.exe", "wmic.exe", "CMSTP.EXE", "wuauclt.exe", "CertUtil.exe") or

  /* programs unsigned or with untrusted code signature status running from users home folder */
  (process.code_signature.trusted != true and process.executable : "?:\\Users\\*") or

  /* suspicious paths */
   process.executable : ("?:\\Users\\Public\\*", "?:\\ProgramData\\*", "?:\\Users\\*\\AppData\\*", "?:\\Windows\\Microsoft.NET\\*")
  )

  /* false positives */
  and not (process.code_signature.subject_name :
                    ("YANDEX LLC", "McAfee, LLC", "AVG Technologies USA, Inc.", "Reason Cybersecurity Inc.") and
           process.code_signature.trusted == true) and
  not (process.name : "wmic.exe" and process.args : "MSFT_MpComputerStatus" and process.args : "get") and
  not (process.name : "rundll32.exe" and process.args :  "?:\\Program Files (x86)\\PCPitstop\\Super Shield\\*") and
  not process.hash.sha256 in ("65aee904ab6008a25963a85941039baae02e9a120e338ad2635ec4be9ddf2e73",
                              "867a86be9ab8dfa8f2d4997dd7f4df584709f9677d35efa94ddf0d2be224351a",
                              "fbdbf5f13818503b5d311c233af6467f5f9a462418bcc4558c1561df0c033d7c",
                              "bca7e687a39ac52d8ddb0e95f0886ba3d194ff55a11cdf09fc2b0da9ebbad572",
                              "11d659e714ff6d393a30c6c560062e82587b50462aeb33db3dda508009d3ed76",
                              "5aff8a288cbb22900a0c21088ca5af4447d492ebc35caed757e93a2ccdfa4455")
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1197"
name = "BITS Jobs"
reference = "https://attack.mitre.org/techniques/T1197/"


[threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[internal]
min_endpoint_version = "7.15.0"