BITS Job Download from File Sharing or Code Hosting Domains

SigmaHQ Detections@sigmaHQ

•updated Sep 22, 2025•0•25

Detects BITS transfer jobs downloading files from known file-sharing or code-hosting domains often abused by adversaries for staging or delivering malicious payloads. This rule specifically looks for EventID 16403 in the BITS client logs, indicating a file transfer, and checks if the remote source domain matches a list of suspicious domains.