Ingress Transfer via Windows BITS

 1[metadata]
 2creation_date = "2023/01/13"
 3integration = ["endpoint"]
 4maturity = "production"
 5min_stack_comments = "New fields added: required_fields, related_integrations, setup"
 6min_stack_version = "8.3.0"
 7updated_date = "2023/10/22"
 8
 9[rule]
10author = ["Elastic"]
11description = """
12Identifies downloads of executable and archive files via the Windows Background Intelligent Transfer Service (BITS). 
13Adversaries could leverage Windows BITS transfer jobs to download remote payloads.
14"""
15from = "now-9m"
16index = ["logs-endpoint.events.*"]
17language = "eql"
18license = "Elastic License v2"
19name = "Ingress Transfer via Windows BITS"
20references = ["https://attack.mitre.org/techniques/T1197/"]
21risk_score = 21
22rule_id = "f95972d3-c23b-463b-89a8-796b3f369b49"
23severity = "low"
24tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Tactic: Command and Control", "Data Source: Elastic Defend"]
25timestamp_override = "event.ingested"
26type = "eql"
27
28query = '''
29file where host.os.type == "windows" and event.action == "rename" and
30  process.name : "svchost.exe" and file.Ext.original.name : "BIT*.tmp" and 
31  (file.extension : ("exe", "zip", "rar", "bat", "dll", "ps1", "vbs", "wsh", "js", "vbe", "pif", "scr", "cmd", "cpl") or
32   file.Ext.header_bytes : "4d5a*") and 
33 
34  /* noisy paths, for hunting purposes you can use the same query without the following exclusions */
35  not file.path : ("?:\\Program Files\\*", "?:\\Program Files (x86)\\*", "?:\\Windows\\*", "?:\\ProgramData\\*\\*") and 
36 
37  /* lot of third party SW use BITS to download executables with a long file name */
38  not length(file.name) > 30 and
39  not file.path : (
40        "?:\\Users\\*\\AppData\\Local\\Temp*\\wct*.tmp",
41        "?:\\Users\\*\\AppData\\Local\\Adobe\\ARM\\*\\RdrServicesUpdater*.exe",
42        "?:\\Users\\*\\AppData\\Local\\Docker Desktop Installer\\update-*.exe"
43  )
44'''
45
46
47[[rule.threat]]
48framework = "MITRE ATT&CK"
49[[rule.threat.technique]]
50id = "T1105"
51name = "Ingress Tool Transfer"
52reference = "https://attack.mitre.org/techniques/T1105/"
53
54
55[rule.threat.tactic]
56id = "TA0011"
57name = "Command and Control"
58reference = "https://attack.mitre.org/tactics/TA0011/"
59
60
61[[rule.threat]]
62framework = "MITRE ATT&CK"
63[[rule.threat.technique]]
64id = "T1197"
65name = "BITS Jobs"
66reference = "https://attack.mitre.org/techniques/T1197/"
67
68
69[rule.threat.tactic]
70id = "TA0005"
71name = "Defense Evasion"
72reference = "https://attack.mitre.org/tactics/TA0005/"