Suspicious Download From File-Sharing Website Via Bitsadmin
Detects the use of 'bitsadmin.exe' to download files from domains commonly associated with file-sharing services or attacker-controlled infrastructure. This technique is often used by adversaries for ingress tool transfer, defense evasion, and persistence.
Sigma
