.NET Loader - BITSAdmin Job Transfer with DLL Renaming
This rule detects the use of BITSAdmin to transfer files from a remote HTTP/HTTPS source where the downloaded file has a common arbitrary extension (txt, dat, bin, jpg) but is being renamed to a .dll extension. This technique is often used by adversaries to stealthily download secondary loaders or malicious DLLs.
Microsoft Sentinel (KQL)
