Detection rules › Sigma
Suspicious Download From File-Sharing Website Via Bitsadmin
Detects usage of bitsadmin downloading a file from a suspicious domain
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Persistence | T1197 BITS Jobs |
| Defense Evasion | T1036.003 Masquerading: Rename Legitimate Utilities, T1197 BITS Jobs |
| Command & Control | T1105 Ingress Tool Transfer |
Event coverage
| Provider | Event ID | Title |
|---|---|---|
| Sysmon | 1 | Process creation |
Stages and Predicates
Stage 1: all of selection_img
or:
Image|endswith: '\bitsadmin.exe'
OriginalFileName: bitsadmin.exe
Stage 2: all of selection_flags
or:
CommandLine|contains: ' /addfile '
CommandLine|contains: ' /create '
CommandLine|contains: ' /transfer '
Stage 3: all of selection_domain
or:
CommandLine|contains: .githubusercontent.com
CommandLine|contains: anonfiles.com
CommandLine|contains: cdn.discordapp.com
CommandLine|contains: ddns.net
CommandLine|contains: dl.dropboxusercontent.com
CommandLine|contains: ghostbin.co
CommandLine|contains: github.com
CommandLine|contains: glitch.me
CommandLine|contains: gofile.io
CommandLine|contains: hastebin.com
CommandLine|contains: mediafire.com
CommandLine|contains: mega.nz
CommandLine|contains: onrender.com
CommandLine|contains: pages.dev
CommandLine|contains: paste.ee
CommandLine|contains: pastebin.com
CommandLine|contains: pastebin.pl
CommandLine|contains: pastetext.net
CommandLine|contains: privatlab.com
CommandLine|contains: privatlab.net
CommandLine|contains: send.exploit.in
CommandLine|contains: sendspace.com
CommandLine|contains: storage.googleapis.com
CommandLine|contains: storjshare.io
CommandLine|contains: supabase.co
CommandLine|contains: temp.sh
CommandLine|contains: transfer.sh
CommandLine|contains: trycloudflare.com
CommandLine|contains: ufile.io
CommandLine|contains: w3spaces.com
CommandLine|contains: workers.dev
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
CommandLine | match |
|
Image | ends_with |
|
OriginalFileName | eq |
|