Remote Command Execution via Bitsadmin
Parses bitsadmin commands executing arbitrary HTTP requests and dropping .exe or .dll files into system paths.
Microsoft Sentinel (KQL)

Parses bitsadmin commands executing arbitrary HTTP requests and dropping .exe or .dll files into system paths.

Already have an account?