BITS Transfer Job Downloading File with Suspicious Extension

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•23

This rule detects when the Background Intelligent Transfer Service (BITS) creates a new transfer job that saves a local file with a potentially suspicious extension. The suspicious extensions include '.bat', '.dll', '.exe', '.hta', '.ps1', '.psd1', '.sh', '.vbe', and '.vbs'. It specifically filters out common legitimate updates from applications like Chrome and Dropbox that download files into 'AppData' directories or from '.com' domains to reduce false positives.