1200KM / sigma-rule
BITS Transfer Job With Uncommon Or Suspicious Remote TLD — Sigma Rule
Sigma rule 6d44fb93-e7d2-475c-9d3d-54c9c1e33427. BITS Transfer Job With Uncommon Or Suspicious Remote TLD — Sigma Rule. Detects a suspicious download using the BITS client from a FQDN that is unusual. Adversaries may abuse BITS jobs to persistently execute or clean up after malicious payloads.
Rule metadata and linked tags
Author: Florian Roth (Nextron Systems). Source status: test; severity: medium. Source dates: 2022-06-10 / 2025-02-28.
{
"product": "windows",
"service": "bits-client"
}Pinned original Sigma rule · Detection Rule License 1.1
Source SHA-256: a99fda620640f78349f6b9bd158fe027567d925572b6670220fc9cac863c08c6
Detection logic
Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.
title: BITS Transfer Job With Uncommon Or Suspicious Remote TLD
id: 6d44fb93-e7d2-475c-9d3d-54c9c1e33427
status: test
description: Detects a suspicious download using the BITS client from a FQDN that is unusual. Adversaries may abuse BITS jobs to persistently execute or clean up after malicious payloads.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1197/T1197.md
- https://twitter.com/malmoeb/status/1535142803075960832
author: Florian Roth (Nextron Systems)
date: 2022-06-10
modified: 2025-02-28
tags:
- attack.persistence
- attack.execution
- attack.stealth
- attack.t1197
logsource:
product: windows
service: bits-client
detection:
selection:
EventID: 16403
filter_main_generic:
RemoteName|contains:
- '.azureedge.net/'
- '.com/'
- '.sfx.ms/'
- 'download.mozilla.org/' # https://download.mozilla.org/?product=firefox-101.0.1-partial-101.0&os=win64&lang=en-US
- 'cdn.onenote.net/'
- 'cdn.office.net/'
- 'tscdn.m365.static.microsoft/'
condition: selection and not 1 of filter_main_*
falsepositives:
- This rule doesn't exclude other known TLDs such as ".org" or ".net". It's recommended to apply additional filters for software and scripts that leverage the BITS service
level: medium
False positives
- This rule doesn't exclude other known TLDs such as ".org" or ".net". It's recommended to apply additional filters for software and scripts that leverage the BITS service
Source references
Connected ecosystem references
Exact source-tagged techniques
Telemetry review
Read the original logsource above, then inspect the linked detection workspaces for technique-level sensor context. No per-rule telemetry equivalence is inferred.
Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.