Detects Bitsadmin connections to domains with uncommon TLDs

Detects a BITS transfer job downloading file(s) from a direct IP address.

Detects BITS transfer job downloading files from a file sharing domain.

Detects new BITS transfer job where the LocalName/Saved file is stored in a potentially suspicious location

Detects new BITS transfer job saving local files with potential suspicious extensions

Detects a suspicious download using the BITS client from a FQDN that is unusual. Adversaries may abuse BITS jobs to persistently execute or clean up after malicious payloads.

Detects the creation of a new bits job by Bitsadmin

Detects the creation of a new bits job by PowerShell

BITS will allow you to schedule a command to execute after a successful download to notify you that the job is finished. When the job runs on the system the command specified in the BITS job will be executed. This can be abused by actors to create a backdoor within the system and for persistence. It will be chained in a BITS job to schedule the download of malware/additional binaries and execute the program after being downloaded

Detects usage of bitsadmin downloading a file

Detects usage of bitsadmin downloading a file to a suspicious target folder

Detects usage of bitsadmin downloading a file to uncommon target folder

Detects usage of bitsadmin downloading a file with a suspicious extension

Detects usage of bitsadmin downloading a file using an URL that contains an IP

Detects usage of bitsadmin downloading a file from a suspicious domain

Detects Bitsadmin connections to IP addresses instead of FQDN names