File Download Via Bitsadmin
Detects the use of the built-in Windows utility bitsadmin.exe to download files. This utility is often abused by adversaries for ingress tool transfer, as it can bypass certain network restrictions and is a living-off-the-land binary (LOLBIN). The rule specifically looks for the execution of bitsadmin.exe with command-line arguments indicative of file transfer operations, such as '/transfer', '/create', '/addfile', and the presence of 'http' to signify a URL download.
Sigma
