BITS Job Transfer - Suspicious Background Download

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•4

This rule detects suspicious background downloads initiated via BITS (Background Intelligent Transfer Service) where the HTTP User-Agent contains "Microsoft BITS" and the requested URI ends with common executable or script file extensions (.exe, .dll, .ps1, .bat). This behavior can indicate an adversary using BITS for ingress tool transfer or to download malicious payloads.