BITSAdmin Connection to Uncommon TLD
Detects connections made by Microsoft BITSAdmin to domains using uncommon Top-Level Domains (TLDs). This can indicate command and control activity or data exfiltration where an adversary is attempting to blend in with legitimate traffic but using less common TLDs to avoid common filtering.
Sigma
