Query: detect Detects usage of bitsadmin downloading a file to a suspicious target folder in logs
Matching passage: Sigma rule: Detects usage of bitsadmin downloading a file to a suspicious target folder. Logsource: windows / process_creation. Rule: title: File Download Via Bitsadmin To A Suspicious Target Folder id: 2ddef153-167b-4e89-86b6-757a9e65dcac related: - id: 6e30c82f-a9f8-4aab-b79c-7c12bce6f248 type: obsolete - id: 1cf465a1-2609-4c15-9b66-c32dbe4bfd67 type: similar status: test description: Detects usage of bitsadmin downloading a file to a suspicious target folder references: - https://blog.netspi.com/15-ways-to-download-a-file/#bitsadmin - https://isc.sans.edu/diary/22264 - https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/ - https://blog.talosintelligence.com/breaking-the-silence-recent-truebot-activity/ author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2022-06-28 modified: 2025-12-10 tags: - attack.persistence - attack.execution - attack.stealth - attack.t1197 - attack.s0190 - attack.t1036.003 - attack.command-and-control - attack.t1105 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \bitsadmin.exe - OriginalFileName: bitsadmin.exe selection_flags: CommandLine|contains: - ' /transfer ' - ' /create ' - ' /addfile ' selection_folder: CommandLine|contains: - :\Perflogs - :\ProgramData\ - :\Temp\ - :\Users\Public\ - :\Windows\ - \$Recycle.Bin\ - \AppData\Local\ - \AppData\Roaming\ - \Contacts\ - \Desktop\ - \Favorites\ - \Favourites\ - \inetpub\wwwroot\ - \Music\ - \Pictures\ - \Start Menu\Programs\Startup\ - \Users\Default\ - \Videos\ - '%ProgramData%' - '%public%' - '%temp%' - '%tmp%' condition: all of selection_* falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_bitsadmin_download_susp_targetfolder/info.yml simulation: - type: atomic-red-team name: Windows - BITSAdmin BITS Download technique: T1105 atomic_guid: a1921cd3-9a2d-47d5-a891-f1d0f2a7a31b
Near-miss passage: Sigma rule: Detects potential commandline obfuscation using unicode characters. Adversaries may attempt to make an executable or fil. Logsource: windows / process_creation. Rule: title: Potential CommandLine Obfuscation Using Unicode Characters From Suspicious Image id: 584bca0f-3608-4402-80fd-4075ff6072e3 related: - id: e0552b19-5a83-4222-b141-b36184bb8d79 type: similar - id: ad691d92-15f2-4181-9aa4-723c74f9ddc3 type: similar - id: 2c0d2d7b-30d6-4d14-9751-7b9113042ab9 type: obsolete status: test description: 'Detects potential commandline obfuscation using unicode characters. Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. ' references: - https://www.wietzebeukema.nl/blog/windows-command-line-obfuscation - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1027/T1027.md#atomic-test-6---dlp-evasion-via-sensitive-data-in-vba-macro-over-http author: frack113, Florian Roth (Nextron Systems), Josh Nickels date: 2024-09-02 modified: 2025-05-30 tags: - attack.stealth - attack.t1027 logsource: category: process_creation product: windows detection: selection_img: Image|endswith: - \cmd.exe - \cscript.exe - \powershell.exe - \powershell_ise.exe - \pwsh.exe - \wscript.exe OriginalFileName: - Cmd.EXE - cscript.exe - PowerShell.EXE - PowerShell_ISE.EXE - pwsh.dll - wscript.exe selection_special_chars: CommandLine|contains: - ˣ - ˪ - ˢ - ∕ - ⁄ - ― - — - - ¯ - ® - ¶ - ⠀ condition: all of selection_* falsepositives: - Unknown level: high