File With Suspicious Extension Downloaded Via Bitsadmin

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•23

Detects the use of bitsadmin.exe to download files with suspicious extensions. This technique is often used by adversaries for defense evasion and persistence by leveraging a legitimate Windows utility to transfer malicious payloads.