Detection rules › By event

Microsoft-Windows-Bits-Client

Event	Rules
Event ID 3	2
Event ID 60	1
Event ID 16403	5

Event ID 3

2 detection rules reference this event. View event page.

Sigma (2)

New BITS Job Created Via Bitsadmin severity low T1197
New BITS Job Created Via PowerShell severity low T1197

Event ID 60

1 detection rules reference this event. View event page.

Sigma (1)

File with high volume downloaded via BITS severity medium T1048, T1105, T1197, T1570

Event ID 16403

5 detection rules reference this event. View event page.

Sigma (5)

BITS Transfer Job Download From Direct IP severity high T1197
BITS Transfer Job Download From File Sharing Domains severity high T1197
BITS Transfer Job Download To Potential Suspicious Folder severity high T1197
BITS Transfer Job Downloading File Potential Suspicious Extension severity medium T1197
BITS Transfer Job With Uncommon Or Suspicious Remote TLD severity medium T1197