Detection rules › Sigma
BITS payload downloaded via commandline
Detects scenarios where an attacker downloads a payload by abusing BITS software. For more precise information, inspect "Bits-client" event log and search for ID 59 and 60.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Persistence | T1197 BITS Jobs |
| Lateral Movement | T1570 Lateral Tool Transfer |
| Command & Control | T1105 Ingress Tool Transfer |
| Exfiltration | T1048 Exfiltration Over Alternative Protocol |
Event coverage
| Provider | Event | Title |
|---|---|---|
| Sysmon | Event ID 1 | Process creation |
| Security-Auditing | Event ID 4688 | A new process has been created. |
Rule body yaml
title: BITS payload downloaded via commandline
description: Detects scenarios where an attacker downloads a payload by abusing BITS software. For more precise information, inspect "Bits-client" event log and search for ID 59 and 60.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0003-Persistence/T1197-BITS%20jobs
- https://medium.com/@threathuntingteam/background-intelligent-transfer-protocol-ab81cd900aa7
- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/bitsadmin-examples
- https://www.microsoft.com/security/blog/2019/12/12/multi-stage-downloader-trojan-sload-abuses-bits-almost-exclusively-for-malicious-activities/
- https://medium.com/@threathuntingteam/background-intelligent-transfer-protocol-ab81cd900aa7
- https://www.hackingarticles.in/windows-for-pentester-bitsadmin/
- https://blog.talosintelligence.com/breaking-the-silence-recent-truebot-activity/
tags:
- attack.exfiltration
- attack.t1048 # Exfiltration Over Alternative Protocol
- attack.lateral_movement
- attack.t1570 # Lateral Tool Transfer
- attack.Command_and_control
- attack.t1105 # Ingress Tool Transfer
- attack.persistence
- attack.t1197 # Bits jobs
author: mdecrevoisier
status: experimental
logsource:
product: windows
category: process_creation
detection:
selection:
NewProcessName|endswith: '\bitsadmin.exe'
CommandLine|contains:
- '/transfer'
- '/download'
condition: selection
falsepositives:
- None
level: medium
Stages and Predicates
Stage 0: condition
selectionStage 1: selection
selection:
NewProcessName|endswith: '\bitsadmin.exe'
CommandLine|contains:
- '/transfer'
- '/download'
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
CommandLine | match |
|
NewProcessName | ends_with |
|