BITS Transfer Job Download From Direct IP
Detects a BITS transfer job downloading file(s) from a direct IP address. This technique is often used by adversaries for defense evasion and persistence, as BITS jobs can operate in the background, bypass some firewall rules, and persist across reboots.
Sigma
