{"id":"9eb68894-7476-4cd6-8752-23b51f5883a7","title":"Bitsadmin to Uncommon TLD","description":"Detects Bitsadmin connections to domains with uncommon TLDs","author":"Florian Roth (Nextron Systems), Tim Shelton","status":"test","level":"high","date":"2019-03-07","modified":"2023-05-17","tags":["attack.command-and-control","attack.execution","attack.stealth","attack.t1071.001","attack.persistence","attack.t1197","attack.s0190"],"technique_ids":["T1071.001","T1197"],"logsource":{"category":"proxy"},"falsepositives":["Rare programs that use Bitsadmin and update from regional TLDs e.g. .uk or .ca"],"references":["https://twitter.com/jhencinski/status/1102695118455349248","https://isc.sans.edu/forums/diary/Investigating+Microsoft+BITS+Activity/23281/"],"source_path":"rules/web/proxy_generic/proxy_ua_bitsadmin_susp_tld.yml","source_sha256":"91d52f2772c0618fb20d0e596eca9c7fcf7f64f5070a772b7c2224efb814d902","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/web/proxy_generic/proxy_ua_bitsadmin_susp_tld.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Bitsadmin to Uncommon TLD\nid: 9eb68894-7476-4cd6-8752-23b51f5883a7\nstatus: test\ndescription: Detects Bitsadmin connections to domains with uncommon TLDs\nreferences:\n    - https://twitter.com/jhencinski/status/1102695118455349248\n    - https://isc.sans.edu/forums/diary/Investigating+Microsoft+BITS+Activity/23281/\nauthor: Florian Roth (Nextron Systems), Tim Shelton\ndate: 2019-03-07\nmodified: 2023-05-17\ntags:\n    - attack.command-and-control\n    - attack.execution\n    - attack.stealth\n    - attack.t1071.001\n    - attack.persistence\n    - attack.t1197\n    - attack.s0190\nlogsource:\n    category: proxy\ndetection:\n    selection:\n        c-useragent|startswith: 'Microsoft BITS/'\n    falsepositives:\n        cs-host|endswith:\n            - '.com'\n            - '.net'\n            - '.org'\n            - '.scdn.co' # spotify streaming\n            - '.sfx.ms' # Microsoft domain, example request: https://oneclient.sfx.ms/PreSignInSettings/Prod/2022-08-15-21-xx-xx/PreSignInSettingsConfig.json\n    condition: selection and not falsepositives\nfalsepositives:\n    - Rare programs that use Bitsadmin and update from regional TLDs e.g. .uk or .ca\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1071.001","id":"T1071.001","name":"Web Protocols","page":"techniques/enterprise/T1071.001/"},{"key":"enterprise/T1197","id":"T1197","name":"BITS Jobs","page":"techniques/enterprise/T1197/"}],"data_path":"data/detection-rules/9eb68894-7476-4cd6-8752-23b51f5883a7.json","kind":"sigma"}