Persistence via BITS Job Notify Cmdline

 1[metadata]
 2creation_date = "2021/12/04"
 3integration = ["endpoint", "windows", "sentinel_one_cloud_funnel", "m365_defender"]
 4maturity = "production"
 5min_stack_comments = "Breaking change at 8.14.0 for the Windows Integration."
 6min_stack_version = "8.14.0"
 7updated_date = "2024/10/15"
 8
 9[rule]
10author = ["Elastic"]
11description = """
12An adversary can use the Background Intelligent Transfer Service (BITS) SetNotifyCmdLine method to execute a program
13that runs after a job finishes transferring data or after a job enters a specified state in order to persist on a
14system.
15"""
16from = "now-9m"
17index = ["logs-endpoint.events.process-*", "winlogbeat-*", "logs-windows.sysmon_operational-*", "endgame-*", "logs-sentinel_one_cloud_funnel.*", "logs-m365_defender.event-*"]
18language = "eql"
19license = "Elastic License v2"
20name = "Persistence via BITS Job Notify Cmdline"
21references = [
22    "https://pentestlab.blog/2019/10/30/persistence-bits-jobs/",
23    "https://docs.microsoft.com/en-us/windows/win32/api/bits1_5/nf-bits1_5-ibackgroundcopyjob2-setnotifycmdline",
24    "https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/bitsadmin-setnotifycmdline",
25    "https://www.elastic.co/blog/hunting-for-persistence-using-elastic-security-part-2",
26]
27risk_score = 47
28rule_id = "c3b915e0-22f3-4bf7-991d-b643513c722f"
29severity = "medium"
30tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Persistence", "Data Source: Elastic Endgame", "Data Source: Elastic Defend", "Data Source: Sysmon", "Data Source: SentinelOne", "Data Source: Microsoft Defender for Endpoint"]
31timestamp_override = "event.ingested"
32type = "eql"
33
34query = '''
35process where host.os.type == "windows" and event.type == "start" and
36  process.parent.name : "svchost.exe" and process.parent.args : "BITS" and
37  not process.executable :
38              ("?:\\Windows\\System32\\WerFaultSecure.exe",
39               "?:\\Windows\\System32\\WerFault.exe",
40               "?:\\Windows\\System32\\wermgr.exe",
41               "?:\\WINDOWS\\system32\\directxdatabaseupdater.exe")
42'''
43
44
45[[rule.threat]]
46framework = "MITRE ATT&CK"
47[[rule.threat.technique]]
48id = "T1197"
49name = "BITS Jobs"
50reference = "https://attack.mitre.org/techniques/T1197/"
51
52
53[rule.threat.tactic]
54id = "TA0003"
55name = "Persistence"
56reference = "https://attack.mitre.org/tactics/TA0003/"

References

• Persistence – BITS Jobs

  

  Windows operating systems contain various utilities which can be used by system administrators to perform various tasks. One of these utilities is the Background Intelligent Transfer Service (BITS)…

  
  Read More

• IBackgroundCopyJob2::SetNotifyCmdLine - Win32 apps

  

  Specifies a program to execute if the job enters the BG_JOB_STATE_ERROR or BG_JOB_STATE_TRANSFERRED state. BITS executes the program in the context of the user who called this method.

  
  Read More

• bitsadmin setnotifycmdline

  

  Reference article for the bitsadmin setnotifycmdline command, which sets the command-line command that will run when the job finishes transferring data, or when a job enters a state.

  
  Read More

• Adversary tradecraft 101: Hunting for persistence using Elastic Security (Part 2) — Elastic Security Labs

  

  Learn how Elastic Endpoint Security and Elastic SIEM can be used to hunt for and detect malicious persistence techniques at scale.

  
  Read More

Related rules

• Adobe Hijack Persistence
• Browser Extension Install
• Creation of a Hidden Local User Account
• Creation or Modification of a new GPO Scheduled Task or Service
• Image File Execution Options Injection