Bitsadmin Activity

Status: available
Severity: medium
Time window: 1h
Source: github.com/Azure/Azure-Sentinel

Background Intelligent Transfer Service (BITS) is a way to reliably download files from webservers or SMB servers. This service is commonly used for legitimate purposes, but can also be used as part of a malware downloader. Additionally, bitsadmin can be used to upload files and therefore can be used for data exfiltration. This query will identify use of bitsadmin.exe for either purpose and will identify directionality file transfer directionality.

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	`T1197` BITS Jobs
Command & Control	`T1105` Ingress Tool Transfer
Exfiltration	`T1048` Exfiltration Over Alternative Protocol

Telemetry coverage

Platform	Record / event type
Microsoft Defender for Endpoint	`DeviceProcessEvents` action `any`: Process activity

Rule body

id: 2a1dc4c2-a8d6-4a0e-8539-9b971c851195
name: Bitsadmin Activity
description: |
  Background Intelligent Transfer Service (BITS) is a way to reliably download files from webservers or SMB servers. 
  This service is commonly used for legitimate purposes, but can also be used as part of a malware downloader. 
  Additionally, bitsadmin can be used to upload files and therefore can be used for data exfiltration. This
  query will identify use of bitsadmin.exe for either purpose and will identify directionality file transfer
  directionality.
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: MicrosoftThreatProtection
    dataTypes:
      - DeviceProcessEvents
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics: 
  - Persistence
  - CommandAndControl
  - Exfiltration
relevantTechniques:
  - T1197
  - T1105
  - T1048
query: |
  DeviceProcessEvents
  | where 
      (FileName =~ "bitsadmin.exe" or column_ifexists('ProcessVersionInfoOriginalFileName','ColumnNotAvailable') =~ 'bitsadmin.exe')
      and ProcessCommandLine has_any ('/Transfer','/AddFile', '/AddFileSet','/AddFileWithRanges')
  | extend 
      ParsedCommandLine = parse_command_line(ProcessCommandLine,'windows')
  | extend     
      RemoteUrl = tostring(ParsedCommandLine[-2]),
      LocalFile= tostring(ParsedCommandLine[-1]),
      Direction = iff(ProcessCommandLine has "/Upload", 'Upload', 'Download')
  | project-reorder 
      TimeGenerated,
      DeviceId,
      DeviceName,
      Direction,
      RemoteUrl,
      LocalFile,
      InitiatingProcessFolderPath,
      InitiatingProcessAccountDomain,
      InitiatingProcessAccountName,
      InitiatingProcessSHA256,
      ProcessId,
      ProcessCommandLine
  | extend HostName = iff(DeviceName has '.', substring(DeviceName, 0, indexof(DeviceName, '.')), DeviceName)
  | extend DnsDomain = iff(DeviceName has '.', substring(DeviceName, indexof(DeviceName, '.') + 1), "")
entityMappings:
  - entityType: Host
    fieldMappings:
      - identifier: FullName
        columnName: DeviceName
      - identifier: HostName
        columnName: HostName
      - identifier: DnsDomain
        columnName: DnsDomain
  - entityType: Process
    fieldMappings:
      - identifier: ProcessId
        columnName: ProcessId
      - identifier: CommandLine
        columnName: ProcessCommandLine
version: 1.0.0
kind: Scheduled

Stages and Predicates

Stage 1: `source`

DeviceProcessEvents

Stage 2: `where`

| where 
    (FileName =~ "bitsadmin.exe" or column_ifexists('ProcessVersionInfoOriginalFileName','ColumnNotAvailable') =~ 'bitsadmin.exe')
    and ProcessCommandLine has_any ('/Transfer','/AddFile', '/AddFileSet','/AddFileWithRanges')

Stage 3: `extend`

| extend 
    ParsedCommandLine = parse_command_line(ProcessCommandLine,'windows')

Stage 4: `extend`

| extend     
    RemoteUrl = tostring(ParsedCommandLine[-2]),
    LocalFile= tostring(ParsedCommandLine[-1]),
    Direction = iff(ProcessCommandLine has "/Upload", 'Upload', 'Download')

Direction =

ifProcessCommandLine has "/Upload"'Upload'

else'Download'

Stage 5: `project-reorder`

| project-reorder 
    TimeGenerated,
    DeviceId,
    DeviceName,
    Direction,
    RemoteUrl,
    LocalFile,
    InitiatingProcessFolderPath,
    InitiatingProcessAccountDomain,
    InitiatingProcessAccountName,
    InitiatingProcessSHA256,
    ProcessId,
    ProcessCommandLine

Stage 6: `extend`

| extend HostName = iff(DeviceName has '.', substring(DeviceName, 0, indexof(DeviceName, '.')), DeviceName)

HostName =

ifDeviceName has "."substring(DeviceName, 0, indexof(DeviceName, '.'))

elseDeviceName

Stage 7: `extend`

| extend DnsDomain = iff(DeviceName has '.', substring(DeviceName, indexof(DeviceName, '.') + 1), "")

DnsDomain =

ifDeviceName has "."substring(DeviceName, (indexof(DeviceName, '.') + 1))

else""

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`FileName`	eq	`bitsadmin.exe`	`field:"file_name" kind:eq value:"bitsadmin.exe"`
`ProcessCommandLine`	match	`/AddFile` transforms: `term` corpus 2 (sigma 1, kusto 1) `/AddFileSet` transforms: `term` `/AddFileWithRanges` transforms: `term` `/Transfer` transforms: `term` corpus 2 (sigma 1, kusto 1)	`field:"CommandLine" kind:match`
`ProcessVersionInfoOriginalFileName`	eq	`bitsadmin.exe` transforms: `column_ifexists` corpus 20 (sigma 9, elastic 8, splunk 2, kusto 1)	`field:"OriginalFileName" kind:eq value:"bitsadmin.exe"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`ParsedCommandLine`	`extend`
`Direction`	`extend`
`LocalFile`	`extend`
`RemoteUrl`	`extend`
`HostName`	`extend`
`DnsDomain`	`extend`

Bitsadmin Activity

MITRE ATT&CK coverage

Telemetry coverage

Rule body

Stages and Predicates

Stage 1: source

Stage 2: where

Stage 3: extend

Stage 4: extend

Stage 5: project-reorder

Stage 6: extend

Stage 7: extend