detection.wiki

Detection rules › Sigma

Bitsadmin to Uncommon TLD

Status
test
Severity
high
Log source
category proxy
Author
Florian Roth (Nextron Systems), Tim Shelton
Source
github.com/SigmaHQ/sigma

Detects Bitsadmin connections to domains with uncommon TLDs

Known false positives

  • Rare programs that use Bitsadmin and update from regional TLDs e.g. .uk or .ca

MITRE ATT&CK coverage

TacticTechniques
Execution
Persistence
Stealth
Command & Control

Rule body

title: Bitsadmin to Uncommon TLD
id: 9eb68894-7476-4cd6-8752-23b51f5883a7
status: test
description: Detects Bitsadmin connections to domains with uncommon TLDs
references:
    - https://twitter.com/jhencinski/status/1102695118455349248
    - https://isc.sans.edu/forums/diary/Investigating+Microsoft+BITS+Activity/23281/
author: Florian Roth (Nextron Systems), Tim Shelton
date: 2019-03-07
modified: 2023-05-17
tags:
    - attack.command-and-control
    - attack.execution
    - attack.stealth
    - attack.t1071.001
    - attack.persistence
    - attack.t1197
    - attack.s0190
logsource:
    category: proxy
detection:
    selection:
        c-useragent|startswith: 'Microsoft BITS/'
    falsepositives:
        cs-host|endswith:
            - '.com'
            - '.net'
            - '.org'
            - '.scdn.co' # spotify streaming
            - '.sfx.ms' # Microsoft domain, example request: https://oneclient.sfx.ms/PreSignInSettings/Prod/2022-08-15-21-xx-xx/PreSignInSettingsConfig.json
    condition: selection and not falsepositives
falsepositives:
    - Rare programs that use Bitsadmin and update from regional TLDs e.g. .uk or .ca
level: high

Stages and Predicates

Stage 0: condition

selection and not falsepositives

Stage 1: selection

selection:
    c-useragent|startswith: 'Microsoft BITS/'

Stage 2: not falsepositives

falsepositives:
    cs-host|endswith:
        - '.com'
        - '.net'
        - '.org'
        - '.scdn.co'
        - '.sfx.ms'

Exclusions

The rule actively suppresses these predicates.

FieldKindExcluded valuesSearch
cs-hostends_with.comexcludes:cs-host field:"cs-host" value:".com"
cs-hostends_with.netexcludes:cs-host field:"cs-host" value:".net"
cs-hostends_with.orgexcludes:cs-host field:"cs-host" value:".org"
cs-hostends_with.scdn.coexcludes:cs-host field:"cs-host" value:".scdn.co"
cs-hostends_with.sfx.msexcludes:cs-host field:"cs-host" value:".sfx.ms"

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
c-useragentstarts_with
  • Microsoft BITS/
field:"c-useragent" kind:starts_with value:"Microsoft BITS/"