detection.wiki

Detection rules › Sigma

BITS Transfer Job Download From Direct IP

Severity
high
Author
Nasreddine Bencherchali (Nextron Systems)
Source
upstream

Detects a BITS transfer job downloading file(s) from a direct IP address.

MITRE ATT&CK coverage

TacticTechniques
PersistenceT1197 BITS Jobs
Defense EvasionT1197 BITS Jobs

Event coverage

ProviderEvent IDTitle
Bits-Client16403

Stages and Predicates

Stage 1: selection

or:
RemoteName|contains: 'http://1'
RemoteName|contains: 'http://2'
RemoteName|contains: 'http://3'
RemoteName|contains: 'http://4'
RemoteName|contains: 'http://5'
RemoteName|contains: 'http://6'
RemoteName|contains: 'http://7'
RemoteName|contains: 'http://8'
RemoteName|contains: 'http://9'
RemoteName|contains: 'https://1'
RemoteName|contains: 'https://2'
RemoteName|contains: 'https://3'
RemoteName|contains: 'https://4'
RemoteName|contains: 'https://5'
RemoteName|contains: 'https://6'
RemoteName|contains: 'https://7'
RemoteName|contains: 'https://8'
RemoteName|contains: 'https://9'

Stage 2: not 1 of filter_optional_*

or:
RemoteName|contains: '://10.'
RemoteName|contains: '://127.'
RemoteName|contains: '://169.254.'
RemoteName|contains: '://172.16.'
RemoteName|contains: '://172.17.'
RemoteName|contains: '://172.18.'
RemoteName|contains: '://172.19.'
RemoteName|contains: '://172.20.'
RemoteName|contains: '://172.21.'
RemoteName|contains: '://172.22.'
RemoteName|contains: '://172.23.'
RemoteName|contains: '://172.24.'
RemoteName|contains: '://172.25.'
RemoteName|contains: '://172.26.'
RemoteName|contains: '://172.27.'
RemoteName|contains: '://172.28.'
RemoteName|contains: '://172.29.'
RemoteName|contains: '://172.30.'
RemoteName|contains: '://172.31.'
RemoteName|contains: '://192.168.'
RemoteName|contains: 'http://7-'
RemoteName|contains: 'https://7-'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
RemoteNamematch
  • ://10.
  • ://127.
  • ://169.254.
  • ://172.16.
  • ://172.17.
  • ://172.18.
  • ://172.19.
  • ://172.20.
  • ://172.21.
  • ://172.22.
  • ://172.23.
  • ://172.24.
  • ://172.25.
  • ://172.26.
  • ://172.27.
  • ://172.28.
  • ://172.29.
  • ://172.30.
  • ://172.31.
  • ://192.168.
  • http://1
  • http://2
  • http://3
  • http://4
  • http://5
  • http://6
  • http://7
  • http://7-
  • http://8
  • http://9
  • https://1
  • https://2
  • https://3
  • https://4
  • https://5
  • https://6
  • https://7
  • https://7-
  • https://8
  • https://9

Neighbors

Broader alternatives (more inclusive than this rule)

These rules match a superset of what this rule catches. They cover the same events plus more. Use them if you want wider coverage and can absorb more false positives.