Persistence via BITS Job Notify Cmdline

 1[metadata]
 2creation_date = "2021/12/04"
 3integration = ["endpoint", "windows"]
 4maturity = "production"
 5min_stack_comments = "New fields added: required_fields, related_integrations, setup"
 6min_stack_version = "8.3.0"
 7updated_date = "2024/03/28"
 8
 9[rule]
10author = ["Elastic"]
11description = """
12An adversary can use the Background Intelligent Transfer Service (BITS) SetNotifyCmdLine method to execute a program
13that runs after a job finishes transferring data or after a job enters a specified state in order to persist on a
14system.
15"""
16from = "now-9m"
17index = ["logs-endpoint.events.process-*", "winlogbeat-*", "logs-windows.sysmon_operational-*", "endgame-*"]
18language = "eql"
19license = "Elastic License v2"
20name = "Persistence via BITS Job Notify Cmdline"
21references = [
22    "https://pentestlab.blog/2019/10/30/persistence-bits-jobs/",
23    "https://docs.microsoft.com/en-us/windows/win32/api/bits1_5/nf-bits1_5-ibackgroundcopyjob2-setnotifycmdline",
24    "https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/bitsadmin-setnotifycmdline",
25    "https://www.elastic.co/blog/hunting-for-persistence-using-elastic-security-part-2",
26]
27risk_score = 47
28rule_id = "c3b915e0-22f3-4bf7-991d-b643513c722f"
29setup = """## Setup
30
31If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
32events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
33Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
34`event.ingested` to @timestamp.
35For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
36"""
37severity = "medium"
38tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Persistence", "Data Source: Elastic Endgame", "Data Source: Elastic Defend", "Data Source: Sysmon"]
39timestamp_override = "event.ingested"
40type = "eql"
41
42query = '''
43process where host.os.type == "windows" and event.type == "start" and
44  process.parent.name : "svchost.exe" and process.parent.args : "BITS" and
45  not process.executable :
46              ("?:\\Windows\\System32\\WerFaultSecure.exe",
47               "?:\\Windows\\System32\\WerFault.exe",
48               "?:\\Windows\\System32\\wermgr.exe",
49               "?:\\WINDOWS\\system32\\directxdatabaseupdater.exe")
50'''
51
52
53[[rule.threat]]
54framework = "MITRE ATT&CK"
55[[rule.threat.technique]]
56id = "T1197"
57name = "BITS Jobs"
58reference = "https://attack.mitre.org/techniques/T1197/"
59
60
61[rule.threat.tactic]
62id = "TA0003"
63name = "Persistence"
64reference = "https://attack.mitre.org/tactics/TA0003/"

References

• Persistence – BITS Jobs

  

  Windows operating systems contain various utilities which can be used by system administrators to perform various tasks. One of these utilities is the Background Intelligent Transfer Service (BITS)…

  
  Read More

• IBackgroundCopyJob2::SetNotifyCmdLine - Win32 apps

  

  Specifies a program to execute if the job enters the BG_JOB_STATE_ERROR or BG_JOB_STATE_TRANSFERRED state. BITS executes the program in the context of the user who called this method.

  
  Read More

• bitsadmin setnotifycmdline

  

  Reference article for the bitsadmin setnotifycmdline command, which sets the command-line command that will run when the job finishes transferring data, or when a job enters a state.

  
  Read More

• Adversary tradecraft 101: Hunting for persistence using Elastic Security (Part 2) — Elastic Security Labs

  

  Learn how Elastic Endpoint Security and Elastic SIEM can be used to hunt for and detect malicious persistence techniques at scale.

  
  Read More

Related rules

• Adobe Hijack Persistence
• Creation of a Hidden Local User Account
• Creation or Modification of a new GPO Scheduled Task or Service
• Execution of Persistent Suspicious Program
• Image File Execution Options Injection