bitsadmin download and execute

 1title: bitsadmin download and execute
 2status: experimental
 3description: Detect bitsadmin download and execute activity
 4author: Joe Security
 5date: 2019-11-25
 6id: 200031
 7threatname:
 8behaviorgroup: 1
 9classification: 8
10mitreattack: 
11
12logsource:
13    category: process_creation
14    product: windows
15detection:
16    selection:
17        CommandLine:
18            - '*bitsadmin /transfer*http*start %APPDATA%*'
19            - '*/transfer*http*.dll&& rundll32*'
20            - '*powershell*start-bitstransfer*start-process*'
21            - '*bitsadmin /transfer*|iex*'
22    condition: selection
23level: critical