Sigma is the open generic signature format for SIEM systems. Each rule below converts to native syntax for Splunk, Elastic, Sentinel, and other SIEMs. Expand any rule to see its raw YAML.
BITS Transfer Job Downloading File Potential Suspicious Extension
Detects new BITS transfer job saving local files with potential suspicious extensions
status testauthor frack113id b85e5894-9b19-4d86-8c87-a2f3b81f0521
view Sigma YAML
title: BITS Transfer Job Downloading File Potential Suspicious Extension
id: b85e5894-9b19-4d86-8c87-a2f3b81f0521
status: test
description: Detects new BITS transfer job saving local files with potential suspicious extensions
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1197/T1197.md
author: frack113
date: 2022-03-01
modified: 2023-03-27
tags:
- attack.persistence
- attack.execution
- attack.stealth
- attack.t1197
logsource:
product: windows
service: bits-client
detection:
selection:
EventID: 16403
LocalName|endswith:
# TODO: Extend this list with more interesting file extensions
- '.bat'
- '.dll'
- '.exe' # TODO: Might wanna comment this if it generates tons of FPs
- '.hta'
- '.ps1'
- '.psd1'
- '.sh'
- '.vbe'
- '.vbs'
filter_optional_generic:
# Typical updates: Chrome, Dropbox etc.
LocalName|contains: '\AppData\'
RemoteName|contains: '.com'
condition: selection and not 1 of filter_optional_*
falsepositives:
- While the file extensions in question can be suspicious at times. It's best to add filters according to your environment to avoid large amount false positives
level: medium
medium
BITS Transfer Job With Uncommon Or Suspicious Remote TLD
Detects a suspicious download using the BITS client from a FQDN that is unusual. Adversaries may abuse BITS jobs to persistently execute or clean up after malicious payloads.
status testauthor Florian Roth (Nextron Systems)id 6d44fb93-e7d2-475c-9d3d-54c9c1e33427
view Sigma YAML
title: BITS Transfer Job With Uncommon Or Suspicious Remote TLD
id: 6d44fb93-e7d2-475c-9d3d-54c9c1e33427
status: test
description: Detects a suspicious download using the BITS client from a FQDN that is unusual. Adversaries may abuse BITS jobs to persistently execute or clean up after malicious payloads.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1197/T1197.md
- https://twitter.com/malmoeb/status/1535142803075960832
author: Florian Roth (Nextron Systems)
date: 2022-06-10
modified: 2025-02-28
tags:
- attack.persistence
- attack.execution
- attack.stealth
- attack.t1197
logsource:
product: windows
service: bits-client
detection:
selection:
EventID: 16403
filter_main_generic:
RemoteName|contains:
- '.azureedge.net/'
- '.com/'
- '.sfx.ms/'
- 'download.mozilla.org/' # https://download.mozilla.org/?product=firefox-101.0.1-partial-101.0&os=win64&lang=en-US
- 'cdn.onenote.net/'
- 'cdn.office.net/'
- 'tscdn.m365.static.microsoft/'
condition: selection and not 1 of filter_main_*
falsepositives:
- This rule doesn't exclude other known TLDs such as ".org" or ".net". It's recommended to apply additional filters for software and scripts that leverage the BITS service
level: medium
medium
File Download Via Bitsadmin
Detects usage of bitsadmin downloading a file
status testauthor Michael Haag, FPT.EagleEyeid d059842b-6b9d-4ed1-b5c3-5b89143c6ede
view Sigma YAML
title: File Download Via Bitsadmin
id: d059842b-6b9d-4ed1-b5c3-5b89143c6ede
status: test
description: Detects usage of bitsadmin downloading a file
references:
- https://blog.netspi.com/15-ways-to-download-a-file/#bitsadmin
- https://isc.sans.edu/diary/22264
- https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/
author: Michael Haag, FPT.EagleEye
date: 2017-03-09
modified: 2023-02-15
tags:
- attack.persistence
- attack.execution
- attack.stealth
- attack.t1197
- attack.s0190
- attack.t1036.003
- attack.command-and-control
- attack.t1105
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: '\bitsadmin.exe'
- OriginalFileName: 'bitsadmin.exe'
selection_cmd:
CommandLine|contains: ' /transfer '
selection_cli_1:
CommandLine|contains:
- ' /create '
- ' /addfile '
selection_cli_2:
CommandLine|contains: 'http'
condition: selection_img and (selection_cmd or all of selection_cli_*)
falsepositives:
- Some legitimate apps use this, but limited.
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_bitsadmin_download/info.yml
simulation:
- type: atomic-red-team
name: Windows - BITSAdmin BITS Download
technique: T1105
atomic_guid: a1921cd3-9a2d-47d5-a891-f1d0f2a7a31b
medium
Monitoring For Persistence Via BITS
BITS will allow you to schedule a command to execute after a successful download to notify you that the job is finished.
When the job runs on the system the command specified in the BITS job will be executed.
This can be abused by actors to create a backdoor within the system and for persistence.
It will be chained in a BITS job to schedule the download of malware/additional binaries and execute the program after being downloaded.
status testauthor Sreemanid b9cbbc17-d00d-4e3d-a827-b06d03d2380d
view Sigma YAML
title: Monitoring For Persistence Via BITS
id: b9cbbc17-d00d-4e3d-a827-b06d03d2380d
status: test
description: |
BITS will allow you to schedule a command to execute after a successful download to notify you that the job is finished.
When the job runs on the system the command specified in the BITS job will be executed.
This can be abused by actors to create a backdoor within the system and for persistence.
It will be chained in a BITS job to schedule the download of malware/additional binaries and execute the program after being downloaded.
references:
- https://www.fireeye.com/blog/threat-research/2020/10/kegtap-and-singlemalt-with-a-ransomware-chaser.html
- http://0xthem.blogspot.com/2014/03/t-emporal-persistence-with-and-schtasks.html
- https://isc.sans.edu/diary/Wipe+the+drive+Stealthy+Malware+Persistence+Mechanism+-+Part+1/15394
author: Sreeman
date: 2020-10-29
modified: 2024-01-25
tags:
- attack.persistence
- attack.execution
- attack.stealth
- attack.t1197
logsource:
product: windows
category: process_creation
detection:
selection_img:
- Image|endswith: '\bitsadmin.exe'
- OriginalFileName: 'bitsadmin.exe'
selection_cli_notify_1:
CommandLine|contains: '/SetNotifyCmdLine'
selection_cli_notify_2:
CommandLine|contains:
- '%COMSPEC%'
- 'cmd.exe'
- 'regsvr32.exe'
selection_cli_add_1:
CommandLine|contains: '/Addfile'
selection_cli_add_2:
CommandLine|contains:
- 'http:'
- 'https:'
- 'ftp:'
- 'ftps:'
condition: selection_img and (all of selection_cli_notify_* or all of selection_cli_add_*)
falsepositives:
- Unknown
level: medium
low
New BITS Job Created Via Bitsadmin
Detects the creation of a new bits job by Bitsadmin
status testauthor frack113id 1ff315dc-2a3a-4b71-8dde-873818d25d39
view Sigma YAML
title: New BITS Job Created Via Bitsadmin
id: 1ff315dc-2a3a-4b71-8dde-873818d25d39
status: test
description: Detects the creation of a new bits job by Bitsadmin
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1197/T1197.md
author: frack113
date: 2022-03-01
modified: 2023-03-27
tags:
- attack.persistence
- attack.execution
- attack.stealth
- attack.t1197
logsource:
product: windows
service: bits-client
detection:
selection:
EventID: 3
processPath|endswith: '\bitsadmin.exe'
condition: selection
falsepositives:
- Many legitimate applications or scripts could leverage "bitsadmin". This event is best correlated with EID 16403 via the JobID field
level: low
low
New BITS Job Created Via PowerShell
Detects the creation of a new bits job by PowerShell
status testauthor frack113id fe3a2d49-f255-4d10-935c-bda7391108eb
view Sigma YAML
title: New BITS Job Created Via PowerShell
id: fe3a2d49-f255-4d10-935c-bda7391108eb
status: test
description: Detects the creation of a new bits job by PowerShell
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1197/T1197.md
author: frack113
date: 2022-03-01
modified: 2023-03-27
tags:
- attack.persistence
- attack.execution
- attack.stealth
- attack.t1197
logsource:
product: windows
service: bits-client
detection:
selection:
EventID: 3
processPath|endswith:
- '\powershell.exe'
- '\pwsh.exe'
condition: selection
falsepositives:
- Administrator PowerShell scripts
level: low