bits_client | Detection.FYI

BITS Transfer Job Download From File Sharing Domains

Oct 25, 2024 · attack.defense-evasion attack.persistence attack.t1197 ·
Share on:

Detects BITS transfer job downloading files from a file sharing domain.

Read More
BITS Transfer Job Download From Direct IP

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.t1197 ·
Share on:

Detects a BITS transfer job downloading file(s) from a direct IP address.

Read More
BITS Transfer Job Download To Potential Suspicious Folder

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.t1197 ·
Share on:

Detects new BITS transfer job where the LocalName/Saved file is stored in a potentially suspicious location

Read More
BITS Transfer Job Downloading File Potential Suspicious Extension

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.t1197 ·
Share on:

Detects new BITS transfer job saving local files with potential suspicious extensions

Read More
BITS Transfer Job With Uncommon Or Suspicious Remote TLD

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.t1197 ·
Share on:

Detects a suspicious download using the BITS client from a FQDN that is unusual. Adversaries may abuse BITS jobs to persistently execute or clean up after malicious payloads.

Read More
New BITS Job Created Via Bitsadmin

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.t1197 ·
Share on:

Detects the creation of a new bits job by Bitsadmin

Read More
New BITS Job Created Via PowerShell

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.t1197 ·
Share on:

Detects the creation of a new bits job by PowerShell

Read More