Detection rules › Kusto Query Language
Bitsadmin Activity
Background Intelligent Transfer Service (BITS) is a way to reliably download files from webservers or SMB servers. This service is commonly used for legitimate purposes, but can also be used as part of a malware downloader. Additionally, bitsadmin can be used to upload files and therefore can be used for data exfiltration. This query will identify use of bitsadmin.exe for either purpose and will identify directionality file transfer directionality.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Persistence | T1197 BITS Jobs |
| Defense Evasion | T1197 BITS Jobs |
| Command & Control | T1105 Ingress Tool Transfer |
| Exfiltration | T1048 Exfiltration Over Alternative Protocol |
Event coverage
| Provider | Event ID | Title |
|---|---|---|
| Sysmon | 1 | Process creation |
| Security-Auditing | 4688 | A new process has been created. |
| Defender-DeviceProcessEvents | 9001000 | Process activity (any) |
Stages and Predicates
Stage 1: source
DeviceProcessEvents
Stage 2: where
and
or
FileName eq "bitsadmin.exe"
macro "(column_ifexists('ProcessVersionInfoOriginalFileName', 'ColumnNotAvailable') =~ 'bitsadmin.exe')"
ProcessCommandLine match ["/Transfer", "/AddFile", "/AddFileSet", "/AddFileWithRanges"]
Stage 3: extend
Stage 4: extend
Stage 5: project-reorder
Stage 6: extend
Stage 7: extend
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
FileName | eq |
|
ProcessCommandLine | match |
|