BITS Job Abuse via PowerShell BitsTransfer to External URLs (T1197)
Detects the creation of BITS jobs using PowerShell that initiates a connection to an external network location, excluding known Microsoft domains. This behavior is often associated with the use of BITS for downloading arbitrary files or tools from non-trusted sources, which is a common technique used in ingress tool transfer.
Microsoft Sentinel (KQL)
