Suspicious Download From File-Sharing Website Via Bitsadmin

calendar Feb 12, 2024 · attack.defense_evasion attack.persistence attack.t1197 attack.s0190 attack.t1036.003  ·
Share on: linkedin copy

Detects usage of bitsadmin downloading a file from a suspicious domain

Sigma rule (View on GitHub)

 1title: Suspicious Download From File-Sharing Website Via Bitsadmin
 2id: 8518ed3d-f7c9-4601-a26c-f361a4256a0c
 3status: experimental
 4description: Detects usage of bitsadmin downloading a file from a suspicious domain
 5references:
 6    - https://blog.netspi.com/15-ways-to-download-a-file/#bitsadmin
 7    - https://isc.sans.edu/diary/22264
 8    - https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/
 9    - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/ransomware-hive-conti-avoslocker
10    - https://www.cisa.gov/uscert/ncas/alerts/aa22-321a
11    - https://www.microsoft.com/en-us/security/blog/2024/01/17/new-ttps-observed-in-mint-sandstorm-campaign-targeting-high-profile-individuals-at-universities-and-research-orgs/
12author: Florian Roth (Nextron Systems)
13date: 2022/06/28
14modified: 2024/02/09
15tags:
16    - attack.defense_evasion
17    - attack.persistence
18    - attack.t1197
19    - attack.s0190
20    - attack.t1036.003
21logsource:
22    category: process_creation
23    product: windows
24detection:
25    selection_img:
26        - Image|endswith: '\bitsadmin.exe'
27        - OriginalFileName: 'bitsadmin.exe'
28    selection_flags:
29        CommandLine|contains:
30            - ' /transfer '
31            - ' /create '
32            - ' /addfile '
33    selection_domain:
34        CommandLine|contains:
35            - '.githubusercontent.com'       # Includes both gists and github repositories / Michael Haag (idea)
36            - 'anonfiles.com'
37            - 'cdn.discordapp.com'
38            - 'cdn.discordapp.com/attachments/'
39            - 'ddns.net'
40            - 'dl.dropboxusercontent.com'
41            - 'ghostbin.co'
42            - 'glitch.me'
43            - 'gofile.io'
44            - 'hastebin.com'
45            - 'mediafire.com'
46            - 'mega.nz'
47            - 'onrender.com'
48            - 'paste.ee'
49            - 'pastebin.com'
50            - 'pastebin.pl'
51            - 'pastetext.net'
52            - 'privatlab.com'
53            - 'privatlab.net'
54            - 'send.exploit.in'
55            - 'sendspace.com'
56            - 'storage.googleapis.com'
57            - 'storjshare.io'
58            - 'supabase.co'
59            - 'temp.sh'
60            - 'transfer.sh'
61            - 'ufile.io'
62    condition: all of selection_*
63fields:
64    - CommandLine
65    - ParentCommandLine
66falsepositives:
67    - Some legitimate apps use this, but limited.
68level: high

References

Related rules

to-top