detection.wiki

Detection rules › Sigma

BITS Transfer Job Download From Direct IP

Status
test
Severity
high
Log source
product windows, service bits-client
Author
Nasreddine Bencherchali (Nextron Systems)
Source
github.com/SigmaHQ/sigma

Detects a BITS transfer job downloading file(s) from a direct IP address.

MITRE ATT&CK coverage

TacticTechniques
ExecutionT1197 BITS Jobs
PersistenceT1197 BITS Jobs
StealthT1197 BITS Jobs

Event coverage

ProviderEventTitle
Bits-ClientEvent ID 16403task_016403

Rule body yaml

title: BITS Transfer Job Download From Direct IP
id: 90f138c1-f578-4ac3-8c49-eecfd847c8b7
related:
    - id: 99c840f2-2012-46fd-9141-c761987550ef
      type: similar
status: test
description: Detects a BITS transfer job downloading file(s) from a direct IP address.
references:
    - https://blog.netspi.com/15-ways-to-download-a-file/#bitsadmin
    - https://isc.sans.edu/diary/22264
    - https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/
    - https://blog.talosintelligence.com/breaking-the-silence-recent-truebot-activity/
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-01-11
modified: 2023-03-27
tags:
    - attack.persistence
    - attack.execution
    - attack.stealth
    - attack.t1197
logsource:
    product: windows
    service: bits-client
detection:
    selection:
        EventID: 16403
        RemoteName|contains:
            - 'http://1'
            - 'http://2'
            - 'http://3'
            - 'http://4'
            - 'http://5'
            - 'http://6'
            - 'http://7'
            - 'http://8'
            - 'http://9'
            - 'https://1'
            - 'https://2'
            - 'https://3'
            - 'https://4'
            - 'https://5'
            - 'https://6'
            - 'https://7'
            - 'https://8'
            - 'https://9'
    filter_optional_local_networks:
        RemoteName|contains:
            - '://10.' # 10.0.0.0/8
            - '://192.168.' # 192.168.0.0/16
            - '://172.16.' # 172.16.0.0/12
            - '://172.17.'
            - '://172.18.'
            - '://172.19.'
            - '://172.20.'
            - '://172.21.'
            - '://172.22.'
            - '://172.23.'
            - '://172.24.'
            - '://172.25.'
            - '://172.26.'
            - '://172.27.'
            - '://172.28.'
            - '://172.29.'
            - '://172.30.'
            - '://172.31.'
            - '://127.' # 127.0.0.0/8
            - '://169.254.' # 169.254.0.0/16
    filter_optional_seven_zip:
        RemoteName|contains:
            # For https://7-zip.org/
            - 'https://7-'
            - 'http://7-'
    condition: selection and not 1 of filter_optional_*
falsepositives:
    - Unknown
level: high

Stages and Predicates

Stage 0: condition

selection and not 1 of filter_optional_*

Stage 1: selection

selection:
    EventID: 16403
    RemoteName|contains:
        - 'http://1'
        - 'http://2'
        - 'http://3'
        - 'http://4'
        - 'http://5'
        - 'http://6'
        - 'http://7'
        - 'http://8'
        - 'http://9'
        - 'https://1'
        - 'https://2'
        - 'https://3'
        - 'https://4'
        - 'https://5'
        - 'https://6'
        - 'https://7'
        - 'https://8'
        - 'https://9'

Stage 2: not filter_optional_*

filter_optional_local_networks:
    RemoteName|contains:
        - '://10.'
        - '://192.168.'
        - '://172.16.'
        - '://172.17.'
        - '://172.18.'
        - '://172.19.'
        - '://172.20.'
        - '://172.21.'
        - '://172.22.'
        - '://172.23.'
        - '://172.24.'
        - '://172.25.'
        - '://172.26.'
        - '://172.27.'
        - '://172.28.'
        - '://172.29.'
        - '://172.30.'
        - '://172.31.'
        - '://127.'
        - '://169.254.'
filter_optional_seven_zip:
    RemoteName|contains:
        - 'https://7-'
        - 'http://7-'

Exclusions

Top-level NOT(...) conjuncts: predicates this rule actively suppresses.

FieldKindExcluded values
RemoteNamematch://10.
RemoteNamematch://127.
RemoteNamematch://169.254.
RemoteNamematch://172.16.
RemoteNamematch://172.17.
RemoteNamematch://172.18.
RemoteNamematch://172.19.
RemoteNamematch://172.20.
RemoteNamematch://172.21.
RemoteNamematch://172.22.
RemoteNamematch://172.23.
RemoteNamematch://172.24.
RemoteNamematch://172.25.
RemoteNamematch://172.26.
RemoteNamematch://172.27.
RemoteNamematch://172.28.
RemoteNamematch://172.29.
RemoteNamematch://172.30.
RemoteNamematch://172.31.
RemoteNamematch://192.168.
RemoteNamematchhttp://7-
RemoteNamematchhttps://7-

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
RemoteNamematch
  • http://1
  • http://2
  • http://3
  • http://4
  • http://5
  • http://6
  • http://7
  • http://8
  • http://9
  • https://1
  • https://2
  • https://3
  • https://4
  • https://5
  • https://6
  • https://7
  • https://8
  • https://9