File Download Via Bitsadmin To An Uncommon Target Folder
Detects the usage of bitsadmin.exe to download files to uncommon target folders such as AppData or Temp directories. This technique is often used by adversaries for ingress tool transfer or to stage malicious payloads.
Sigma
