BITS Transfer Job Download To Potential Suspicious Folder

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•21

Detects new BITS transfer job where the LocalName/Saved file is stored in a potentially suspicious location, such as Desktop, C:\Users\Public\, or C:\PerfLogs\.