detection.wiki

Detection rules › Sigma

File Download Via Bitsadmin

Status
test
Severity
medium
Log source
product windows, category process_creation
Author
Michael Haag, FPT.EagleEye
Source
github.com/SigmaHQ/sigma

Detects usage of bitsadmin downloading a file

MITRE ATT&CK coverage

TacticTechniques
ExecutionT1197 BITS Jobs
PersistenceT1197 BITS Jobs
StealthT1036.003 Masquerading: Rename Legitimate Utilities, T1197 BITS Jobs
Command & ControlT1105 Ingress Tool Transfer

Event coverage

ProviderEventTitle
SysmonEvent ID 1Process creation

Rule body yaml

title: File Download Via Bitsadmin
id: d059842b-6b9d-4ed1-b5c3-5b89143c6ede
status: test
description: Detects usage of bitsadmin downloading a file
references:
    - https://blog.netspi.com/15-ways-to-download-a-file/#bitsadmin
    - https://isc.sans.edu/diary/22264
    - https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/
author: Michael Haag, FPT.EagleEye
date: 2017-03-09
modified: 2023-02-15
tags:
    - attack.persistence
    - attack.execution
    - attack.stealth
    - attack.t1197
    - attack.s0190
    - attack.t1036.003
    - attack.command-and-control
    - attack.t1105
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\bitsadmin.exe'
        - OriginalFileName: 'bitsadmin.exe'
    selection_cmd:
        CommandLine|contains: ' /transfer '
    selection_cli_1:
        CommandLine|contains:
            - ' /create '
            - ' /addfile '
    selection_cli_2:
        CommandLine|contains: 'http'
    condition: selection_img and (selection_cmd or all of selection_cli_*)
falsepositives:
    - Some legitimate apps use this, but limited.
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_bitsadmin_download/info.yml
simulation:
    - type: atomic-red-team
      name: Windows - BITSAdmin BITS Download
      technique: T1105
      atomic_guid: a1921cd3-9a2d-47d5-a891-f1d0f2a7a31b

Stages and Predicates

Stage 0: condition

selection_img and (selection_cmd or all of selection_cli_*)

Stage 1: selection_img

selection_img:
    - Image|endswith: '\bitsadmin.exe'
    - OriginalFileName: 'bitsadmin.exe'

Stage 2: selection_cmd

selection_cmd:
    CommandLine|contains: ' /transfer '

Stage 3: selection_cli_1

selection_cli_1:
    CommandLine|contains:
        - ' /create '
        - ' /addfile '

Stage 4: selection_cli_2

selection_cli_2:
    CommandLine|contains: 'http'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
CommandLinematch
  • /addfile corpus 5 (sigma 5)
  • /create corpus 15 (sigma 15)
  • /transfer corpus 5 (sigma 5)
  • http corpus 39 (sigma 34, elastic 2, chronicle 2, splunk 1)
Imageends_with
  • \bitsadmin.exe corpus 29 (sigma 29)
OriginalFileNameeq
  • bitsadmin.exe corpus 12 (sigma 9, splunk 2, kusto 1)