COLDRIVER BITSAdmin Download from Delivery Domain

Lacey Cochrane@NullVectorX

•updated Dec 24, 2025•2•0•126

This rule detects the use of bitsadmin to download specific Python scripts ('libsystemhealthcheck.py' or 'libcryptopydatasize.py') from the 'inspectguarantee.org' domain. This activity is associated with the COLDDRIVER (Star Blizzard) threat group, which uses BITSAdmin for ingress tool transfer.