Query: detection rule: Detects a BITS transfer job downloading file(s) from a direct IP address.
Matching passage: Sigma rule: Detects a BITS transfer job downloading file(s) from a direct IP address.. Logsource: windows / bits-client. Rule: title: BITS Transfer Job Download From Direct IP id: 90f138c1-f578-4ac3-8c49-eecfd847c8b7 related: - id: 99c840f2-2012-46fd-9141-c761987550ef type: similar status: test description: Detects a BITS transfer job downloading file(s) from a direct IP address. references: - https://blog.netspi.com/15-ways-to-download-a-file/#bitsadmin - https://isc.sans.edu/diary/22264 - https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/ - https://blog.talosintelligence.com/breaking-the-silence-recent-truebot-activity/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-11 modified: 2023-03-27 tags: - attack.persistence - attack.execution - attack.stealth - attack.t1197 logsource: product: windows service: bits-client detection: selection: EventID: 16403 RemoteName|contains: - http://1 - http://2 - http://3 - http://4 - http://5 - http://6 - http://7 - http://8 - http://9 - https://1 - https://2 - https://3 - https://4 - https://5 - https://6 - https://7 - https://8 - https://9 filter_optional_local_networks: RemoteName|contains: - ://10. - ://192.168. - ://172.16. - ://172.17. - ://172.18. - ://172.19. - ://172.20. - ://172.21. - ://172.22. - ://172.23. - ://172.24. - ://172.25. - ://172.26. - ://172.27. - ://172.28. - ://172.29. - ://172.30. - ://172.31. - ://127. - ://169.254. filter_optional_seven_zip: RemoteName|contains: - https://7- - http://7- condition: selection and not 1 of filter_optional_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the execution of powershell scripts with calls to the "Start-NetEventSession" cmdlet. Which allows an attacker t. Logsource: windows / ps_script. Rule: title: Potential Packet Capture Activity Via Start-NetEventSession - ScriptBlock id: da34e323-1e65-42db-83be-a6725ac2caa3 status: test description: 'Detects the execution of powershell scripts with calls to the "Start-NetEventSession" cmdlet. Which allows an attacker to start event and packet capture for a network event session. Adversaries may attempt to capture network to gather information over the course of an operation. Data captured via this technique may include user credentials, especially those sent over an insecure, unencrypted protocol. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/5f866ca4517e837c4ea576e7309d0891e78080a8/atomics/T1040/T1040.md#atomic-test-16---powershell-network-sniffing - https://github.com/0xsyr0/Awesome-Cybersecurity-Handbooks/blob/7b8935fe4c82cb64d61343de1a8b2e38dd968534/handbooks/10_post_exploitation.md - https://github.com/forgottentq/powershell/blob/9e616363d497143dc955c4fdce68e5c18d28a6cb/captureWindows-Endpoint.ps1#L13 author: frack113 date: 2024-05-12 tags: - attack.credential-access - attack.discovery - attack.t1040 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains: Start-NetEventSession condition: selection falsepositives: - Legitimate network diagnostic scripts. level: medium