{"id":"d059842b-6b9d-4ed1-b5c3-5b89143c6ede","title":"File Download Via Bitsadmin","description":"Detects usage of bitsadmin downloading a file","author":"Michael Haag, FPT.EagleEye","status":"test","level":"medium","date":"2017-03-09","modified":"2023-02-15","tags":["attack.persistence","attack.execution","attack.stealth","attack.t1197","attack.s0190","attack.t1036.003","attack.command-and-control","attack.t1105"],"technique_ids":["T1036.003","T1105","T1197"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Some legitimate apps use this, but limited."],"references":["https://blog.netspi.com/15-ways-to-download-a-file/#bitsadmin","https://isc.sans.edu/diary/22264","https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/"],"source_path":"rules/windows/process_creation/proc_creation_win_bitsadmin_download.yml","source_sha256":"26747eb1e298fb9243b12057545424ea3a51733c1dc9dc03dcbb2e32339e70bc","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_bitsadmin_download.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: File Download Via Bitsadmin\nid: d059842b-6b9d-4ed1-b5c3-5b89143c6ede\nstatus: test\ndescription: Detects usage of bitsadmin downloading a file\nreferences:\n    - https://blog.netspi.com/15-ways-to-download-a-file/#bitsadmin\n    - https://isc.sans.edu/diary/22264\n    - https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/\nauthor: Michael Haag, FPT.EagleEye\ndate: 2017-03-09\nmodified: 2023-02-15\ntags:\n    - attack.persistence\n    - attack.execution\n    - attack.stealth\n    - attack.t1197\n    - attack.s0190\n    - attack.t1036.003\n    - attack.command-and-control\n    - attack.t1105\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_img:\n        - Image|endswith: '\\bitsadmin.exe'\n        - OriginalFileName: 'bitsadmin.exe'\n    selection_cmd:\n        CommandLine|contains: ' /transfer '\n    selection_cli_1:\n        CommandLine|contains:\n            - ' /create '\n            - ' /addfile '\n    selection_cli_2:\n        CommandLine|contains: 'http'\n    condition: selection_img and (selection_cmd or all of selection_cli_*)\nfalsepositives:\n    - Some legitimate apps use this, but limited.\nlevel: medium\nregression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_bitsadmin_download/info.yml\nsimulation:\n    - type: atomic-red-team\n      name: Windows - BITSAdmin BITS Download\n      technique: T1105\n      atomic_guid: a1921cd3-9a2d-47d5-a891-f1d0f2a7a31b\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1036.003","id":"T1036.003","name":"Rename Legitimate Utilities","page":"techniques/enterprise/T1036.003/"},{"key":"enterprise/T1105","id":"T1105","name":"Ingress Tool Transfer","page":"techniques/enterprise/T1105/"},{"key":"enterprise/T1197","id":"T1197","name":"BITS Jobs","page":"techniques/enterprise/T1197/"}],"data_path":"data/detection-rules/d059842b-6b9d-4ed1-b5c3-5b89143c6ede.json","kind":"sigma"}