BITS Client BitsProxy DLL Loaded By Uncommon Process

SigmaHQ Detections@sigmaHQ

•updated Jun 12, 2025•1•0•18

This rule detects when the "BitsProxy.dll" is loaded by a process that is not part of a predefined list of legitimate system or application processes. The "BitsProxy.dll" is associated with the Background Intelligent Transfer Service (BITS) COM instance or API. Detecting its loading by uncommon processes can indicate suspicious activity, potentially related to adversaries abusing BITS for various purposes such as persistence, data transfer, or command and control.