BITS Transfer Job With Uncommon Or Suspicious Remote TLD

SigmaHQ Detections@sigmaHQ

•updated Dec 27, 2024•0•24

Detects a suspicious download using the BITS client from a FQDN that is unusual. Adversaries may abuse BITS jobs to persistently execute or clean up after malicious payloads. The rule specifically looks for BITS client event ID 16403 (BITS job completed) and filters out common and legitimate remote domains to identify potentially malicious or uncommon sources.