Suspicious Download From Direct IP Via Bitsadmin
Detects the use of bitsadmin.exe to download a file from a direct IP address. This technique is often used by adversaries for ingress tool transfer or to establish persistence by downloading malicious payloads directly from an IP address, bypassing typical domain-based filtering or logging.
Sigma
