{"id":"2ddef153-167b-4e89-86b6-757a9e65dcac","title":"File Download Via Bitsadmin To A Suspicious Target Folder","description":"Detects usage of bitsadmin downloading a file to a suspicious target folder","author":"Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2022-06-28","modified":"2025-12-10","tags":["attack.persistence","attack.execution","attack.stealth","attack.t1197","attack.s0190","attack.t1036.003","attack.command-and-control","attack.t1105"],"technique_ids":["T1036.003","T1105","T1197"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Unknown"],"references":["https://blog.netspi.com/15-ways-to-download-a-file/#bitsadmin","https://isc.sans.edu/diary/22264","https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/","https://blog.talosintelligence.com/breaking-the-silence-recent-truebot-activity/"],"source_path":"rules/windows/process_creation/proc_creation_win_bitsadmin_download_susp_targetfolder.yml","source_sha256":"3a8da5214cd719fef00fcd3d081d57eac045a4fbe52dcb1cefe52406fa868387","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_bitsadmin_download_susp_targetfolder.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: File Download Via Bitsadmin To A Suspicious Target Folder\nid: 2ddef153-167b-4e89-86b6-757a9e65dcac\nrelated:\n    - id: 6e30c82f-a9f8-4aab-b79c-7c12bce6f248\n      type: obsolete\n    - id: 1cf465a1-2609-4c15-9b66-c32dbe4bfd67\n      type: similar\nstatus: test\ndescription: Detects usage of bitsadmin downloading a file to a suspicious target folder\nreferences:\n    - https://blog.netspi.com/15-ways-to-download-a-file/#bitsadmin\n    - https://isc.sans.edu/diary/22264\n    - https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/\n    - https://blog.talosintelligence.com/breaking-the-silence-recent-truebot-activity/\nauthor: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)\ndate: 2022-06-28\nmodified: 2025-12-10\ntags:\n    - attack.persistence\n    - attack.execution\n    - attack.stealth\n    - attack.t1197\n    - attack.s0190\n    - attack.t1036.003\n    - attack.command-and-control\n    - attack.t1105\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_img:\n        - Image|endswith: '\\bitsadmin.exe'\n        - OriginalFileName: 'bitsadmin.exe'\n    selection_flags:\n        CommandLine|contains:\n            - ' /transfer '\n            - ' /create '\n            - ' /addfile '\n    selection_folder:\n        CommandLine|contains:\n            - ':\\Perflogs'\n            - ':\\ProgramData\\'\n            - ':\\Temp\\'\n            - ':\\Users\\Public\\'\n            - ':\\Windows\\'\n            - '\\$Recycle.Bin\\'\n            - '\\AppData\\Local\\'\n            - '\\AppData\\Roaming\\'\n            - '\\Contacts\\'\n            - '\\Desktop\\'\n            - '\\Favorites\\'\n            - '\\Favourites\\'\n            - '\\inetpub\\wwwroot\\'\n            - '\\Music\\'\n            - '\\Pictures\\'\n            - '\\Start Menu\\Programs\\Startup\\'\n            - '\\Users\\Default\\'\n            - '\\Videos\\'\n            - '%ProgramData%'\n            - '%public%'\n            - '%temp%'\n            - '%tmp%'\n    condition: all of selection_*\nfalsepositives:\n    - Unknown\nlevel: high\nregression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_bitsadmin_download_susp_targetfolder/info.yml\nsimulation:\n    - type: atomic-red-team\n      name: Windows - BITSAdmin BITS Download\n      technique: T1105\n      atomic_guid: a1921cd3-9a2d-47d5-a891-f1d0f2a7a31b\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1036.003","id":"T1036.003","name":"Rename Legitimate Utilities","page":"techniques/enterprise/T1036.003/"},{"key":"enterprise/T1105","id":"T1105","name":"Ingress Tool Transfer","page":"techniques/enterprise/T1105/"},{"key":"enterprise/T1197","id":"T1197","name":"BITS Jobs","page":"techniques/enterprise/T1197/"}],"data_path":"data/detection-rules/2ddef153-167b-4e89-86b6-757a9e65dcac.json","kind":"sigma"}