{"id":"5b80a791-ad9b-4b75-bcc1-ad4e1e89c200","title":"File With Suspicious Extension Downloaded Via Bitsadmin","description":"Detects usage of bitsadmin downloading a file with a suspicious extension","author":"Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2022-06-28","modified":"2023-05-30","tags":["attack.persistence","attack.execution","attack.stealth","attack.t1197","attack.s0190","attack.t1036.003","attack.command-and-control","attack.t1105"],"technique_ids":["T1036.003","T1105","T1197"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Unknown"],"references":["https://blog.netspi.com/15-ways-to-download-a-file/#bitsadmin","https://isc.sans.edu/diary/22264","https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/"],"source_path":"rules/windows/process_creation/proc_creation_win_bitsadmin_download_susp_extensions.yml","source_sha256":"7a862f3df49d08914053529dc5cf37e22509e8ea3fc0f4fac821c3cfaf6ccf79","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_bitsadmin_download_susp_extensions.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: File With Suspicious Extension Downloaded Via Bitsadmin\nid: 5b80a791-ad9b-4b75-bcc1-ad4e1e89c200\nstatus: test\ndescription: Detects usage of bitsadmin downloading a file with a suspicious extension\nreferences:\n    - https://blog.netspi.com/15-ways-to-download-a-file/#bitsadmin\n    - https://isc.sans.edu/diary/22264\n    - https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/\nauthor: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)\ndate: 2022-06-28\nmodified: 2023-05-30\ntags:\n    - attack.persistence\n    - attack.execution\n    - attack.stealth\n    - attack.t1197\n    - attack.s0190\n    - attack.t1036.003\n    - attack.command-and-control\n    - attack.t1105\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_img:\n        - Image|endswith: '\\bitsadmin.exe'\n        - OriginalFileName: 'bitsadmin.exe'\n    selection_flags:\n        CommandLine|contains:\n            - ' /transfer '\n            - ' /create '\n            - ' /addfile '\n    selection_extension:\n        CommandLine|contains:\n            - '.7z'\n            - '.asax'\n            - '.ashx'\n            - '.asmx'\n            - '.asp'\n            - '.aspx'\n            - '.bat'\n            - '.cfm'\n            - '.cgi'\n            - '.chm'\n            - '.cmd'\n            - '.dll'\n            - '.gif'\n            - '.jpeg'\n            - '.jpg'\n            - '.jsp'\n            - '.jspx'\n            - '.log'\n            - '.png'\n            - '.ps1'\n            - '.psm1'\n            - '.rar'\n            - '.scf'\n            - '.sct'\n            - '.txt'\n            - '.vbe'\n            - '.vbs'\n            - '.war'\n            - '.wsf'\n            - '.wsh'\n            - '.xll'\n            - '.zip'\n    condition: all of selection_*\nfalsepositives:\n    - Unknown\nlevel: high\nregression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_bitsadmin_download_susp_extensions/info.yml\nsimulation:\n    - type: atomic-red-team\n      name: Windows - BITSAdmin BITS Download\n      technique: T1105\n      atomic_guid: a1921cd3-9a2d-47d5-a891-f1d0f2a7a31b\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1036.003","id":"T1036.003","name":"Rename Legitimate Utilities","page":"techniques/enterprise/T1036.003/"},{"key":"enterprise/T1105","id":"T1105","name":"Ingress Tool Transfer","page":"techniques/enterprise/T1105/"},{"key":"enterprise/T1197","id":"T1197","name":"BITS Jobs","page":"techniques/enterprise/T1197/"}],"data_path":"data/detection-rules/5b80a791-ad9b-4b75-bcc1-ad4e1e89c200.json","kind":"sigma"}