Bitsadmin to Uncommon IP Server Address

calendar Apr 28, 2026 · attack.command-and-control attack.execution attack.stealth attack.t1071.001 attack.persistence attack.t1197 attack.s0190  ·
Share on: linkedin copy

Detects Bitsadmin connections to IP addresses instead of FQDN names

Sigma rule (View on GitHub)

 1title: Bitsadmin to Uncommon IP Server Address
 2id: 8ccd35a2-1c7c-468b-b568-ac6cdf80eec3
 3status: test
 4description: Detects Bitsadmin connections to IP addresses instead of FQDN names
 5references:
 6    - https://isc.sans.edu/diary/Microsoft+BITS+Used+to+Download+Payloads/21027
 7author: Florian Roth (Nextron Systems)
 8date: 2022-06-10
 9modified: 2022-08-24
10tags:
11    - attack.command-and-control
12    - attack.execution
13    - attack.stealth
14    - attack.t1071.001
15    - attack.persistence
16    - attack.t1197
17    - attack.s0190
18logsource:
19    category: proxy
20detection:
21    selection:
22        c-useragent|startswith: 'Microsoft BITS/'
23        cs-host|endswith:
24            - '1'
25            - '2'
26            - '3'
27            - '4'
28            - '5'
29            - '6'
30            - '7'
31            - '8'
32            - '9'
33    condition: selection
34falsepositives:
35    - Unknown
36level: high

References

Related rules

to-top