Detection rules › By catalog entry

Microsoft-Windows-Bits-Client

Catalog entry	Rules
Event ID 3	2
Event ID 60	1
Event ID 16403	5

Event ID 3

2 detection rules reference this catalog entry. View catalog entry.

Sigma (2)

New BITS Job Created Via Bitsadmin severity low T1197
New BITS Job Created Via PowerShell severity low T1197

Event ID 60

1 detection rules reference this catalog entry. View catalog entry.

Sigma (1)

File with high volume downloaded via BITS severity medium T1048,T1105,T1197,T1570

Event ID 16403

5 detection rules reference this catalog entry. View catalog entry.

Sigma (5)

BITS Transfer Job Download From Direct IP severity high T1197
BITS Transfer Job Download From File Sharing Domains severity high T1197
BITS Transfer Job Download To Potential Suspicious Folder severity high T1197
BITS Transfer Job Downloading File Potential Suspicious Extension severity medium T1197
BITS Transfer Job With Uncommon Or Suspicious Remote TLD severity medium T1197

Back to all Microsoft-Windows-Bits-Client catalog entries