MITRE ATT&CK technique
BITS Jobs detection rulesT1197
BITS Jobs (T1197) is a MITRE ATT&CK technique in the Execution tactic. This page lists the 16 community-maintained Sigma detection rules in the library mapped to T1197 and its sub-techniques. Each rule includes its detection logic, log source, false positives and original YAML. These rules mainly target windows.
BITS Transfer Job Download From Direct IP
highDetects a BITS transfer job downloading file(s) from a direct IP address.
windows
BITS Transfer Job Download From File Sharing Domains
highDetects BITS transfer job downloading files from a file sharing domain.
windows
BITS Transfer Job Download To Potential Suspicious Folder
highDetects new BITS transfer job where the LocalName/Saved file is stored in a potentially suspicious location
windows
Bitsadmin to Uncommon IP Server Address
highDetects Bitsadmin connections to IP addresses instead of FQDN names
proxy
Bitsadmin to Uncommon TLD
highDetects Bitsadmin connections to domains with uncommon TLDs
proxy
File Download Via Bitsadmin To A Suspicious Target Folder
highDetects usage of bitsadmin downloading a file to a suspicious target folder
windows · process_creation
File With Suspicious Extension Downloaded Via Bitsadmin
highDetects usage of bitsadmin downloading a file with a suspicious extension
windows · process_creation
Suspicious Download From Direct IP Via Bitsadmin
highDetects usage of bitsadmin downloading a file using an URL that contains an IP
windows · process_creation
Suspicious Download From File-Sharing Website Via Bitsadmin
highDetects usage of bitsadmin downloading a file from a suspicious domain
windows · process_creation
BITS Transfer Job Downloading File Potential Suspicious Extension
mediumDetects new BITS transfer job saving local files with potential suspicious extensions
windows
BITS Transfer Job With Uncommon Or Suspicious Remote TLD
mediumDetects a suspicious download using the BITS client from a FQDN that is unusual. Adversaries may abuse BITS jobs to persistently execute or clean up after malicious payloads.
windows
File Download Via Bitsadmin
mediumDetects usage of bitsadmin downloading a file
windows · process_creation
Monitoring For Persistence Via BITS
mediumBITS will allow you to schedule a command to execute after a successful download to notify you that the job is finished. When the job runs on the system the command specified in the BITS job will be executed. This can be abused by actors to create a backdoor within the system and for persistence. It will be chained in a BITS job to schedule the download of malware/additional binaries and execute the program after being downloaded.
windows · process_creation
BITS Client BitsProxy DLL Loaded By Uncommon Process
lowDetects an uncommon process loading the "BitsProxy.dll". This DLL is used when the BITS COM instance or API is used. This detection can be used to hunt for uncommon processes loading this DLL in your environment. Which may indicate potential suspicious activity occurring.
windows · image_load
New BITS Job Created Via Bitsadmin
lowDetects the creation of a new bits job by Bitsadmin
windows
New BITS Job Created Via PowerShell
lowDetects the creation of a new bits job by PowerShell
windows