Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
173 detections
Filters
Last updated
All Time
Detection languages
78
46
20
15
5
Contributors
38
36
26
14
14
Categories
115
81
74
18
18
Platforms
171
3
1
1
Products / Services
70
41
32
30
14
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
CVEs
1
1
1
IDS Classtypes
3
IDS Protocols
3
Detects usage of bitsadmin downloading a file with a suspicious extension
Finds PowerShell execution events that could involve a download.
This rule detects when the "BitsProxy.dll" is loaded by a process that is not part of a predefined list of legitimate system or application processes. The "BitsProxy.dll" is associated with the Background Intelligent Transfer Service (BITS) COM instance or API. Detecting its loading by uncommon processes can indicate suspicious activity, potentially related to adversaries abusing BITS for various purposes such as persistence, data transfer, or command and control.
Detects a suspicious process spawning from one of the Microsoft Office suite products (Word, Excel, PowerPoint, Publisher, Visio, etc.). This often indicates an attempt to execute malicious code via Office applications, leveraging common living-off-the-land binaries (LOLBINs) or other suspicious executables.
Detects suspicious command execution patterns in the RunMRU registry key often associated with Lumma Stealer ClickFix delivery using specific executables and unusual character sets.
The following analytic detects the use of `bitsadmin.exe` to schedule a BITS job for persistence on an endpoint. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on specific command-line parameters such as `create`, `addfile`, and `resume`. This activity is significant because BITS jobs can be used by attackers to maintain persistence, download malicious payloads, or exfiltrate data. If confirmed malicious, this could allow an attacker to persist in the environment, execute arbitrary code, or transfer sensitive information, necessitating further investigation and potential remediation.
The following analytic detects the execution of the PowerShell command `Start-BitsTransfer`, which can be used for file transfers, including potential data exfiltration. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process creation events and command-line arguments. This activity is significant because `Start-BitsTransfer` can be abused by adversaries to upload sensitive files to remote locations, posing a risk of data loss. If confirmed malicious, this could lead to unauthorized data exfiltration, compromising sensitive information and potentially leading to further exploitation of the network.
Detects a suspicious download using the BITS client from a FQDN that is unusual. Adversaries may abuse BITS jobs to persistently execute or clean up after malicious payloads.
Detects a suspicious download using the BITS client from a FQDN that is unusual. Adversaries may abuse BITS jobs to persistently execute or clean up after malicious payloads. The rule specifically looks for BITS client event ID 16403 (BITS job completed) and filters out common and legitimate remote domains to identify potentially malicious or uncommon sources.
Detects suspicious child processes spawned by common Windows shell and scripting processes such as mshta.exe, powershell.exe, rundll32.exe, cscript.exe, wscript.exe, wmiprvse.exe, and regsvr32.exe. The suspicious child processes include schtasks.exe, nslookup.exe, certutil.exe, bitsadmin.exe, and mshta.exe, which are often abused for various malicious activities like persistence, data exfiltration, or further execution.
Detects suspicious scheduled task creation events by analyzing the task content for unusual paths (e.g., temporary directories, user-writable locations) and the presence of commonly abused command-line utilities or scripting interpreters. This rule aims to identify persistence or execution mechanisms leveraging scheduled tasks.
This rule detects the use of Background Intelligent Transfer Service (BITS) to connect to IP addresses directly, rather than fully qualified domain names (FQDNs). This behavior can be indicative of malicious activity, as adversaries often use BITS for command and control or data transfer, and connecting to IP addresses can be a way to bypass DNS-based security controls or to obscure the true destination.
Detects the creation of a new Background Intelligent Transfer Service (BITS) job by the `bitsadmin.exe` utility. Adversaries may use BITS jobs for various purposes, including downloading malicious files, maintaining persistence, or exfiltrating data, as BITS jobs can operate in the background and persist across reboots.
Detects a BITS transfer job downloading file(s) from a direct IP address. This technique is often used by adversaries for defense evasion and persistence, as BITS jobs can operate in the background, bypass some firewall rules, and persist across reboots.
Detects connections made by Microsoft BITSAdmin to domains using uncommon Top-Level Domains (TLDs). This can indicate command and control activity or data exfiltration where an adversary is attempting to blend in with legitimate traffic but using less common TLDs to avoid common filtering.
This rule detects when the Background Intelligent Transfer Service (BITS) creates a new transfer job that saves a local file with a potentially suspicious extension. The suspicious extensions include '.bat', '.dll', '.exe', '.hta', '.ps1', '.psd1', '.sh', '.vbe', and '.vbs'. It specifically filters out common legitimate updates from applications like Chrome and Dropbox that download files into 'AppData' directories or from '.com' domains to reduce false positives.
Detects the use of bitsadmin.exe to download files with suspicious extensions. This technique is often used by adversaries for defense evasion and persistence by leveraging a legitimate Windows utility to transfer malicious payloads.
Detects the use of the built-in Windows utility bitsadmin.exe to download files. This utility is often abused by adversaries for ingress tool transfer, as it can bypass certain network restrictions and is a living-off-the-land binary (LOLBIN). The rule specifically looks for the execution of bitsadmin.exe with command-line arguments indicative of file transfer operations, such as '/transfer', '/create', '/addfile', and the presence of 'http' to signify a URL download.
Detects WMIC executing "process call create" with suspicious calls to processes such as "rundll32", "regsrv32", "bitsadmin", "certutil", "cscript", "wscript", "mshta", or commands involving 'cmd.exe' or 'powershell', or paths like 'Users\Public', 'Windows\Temp', 'AppData\Local', and common temporary/program data environment variables. This indicates potential malicious execution or persistence.
Detects the creation of a new Background Intelligent Transfer Service (BITS) job by PowerShell. Adversaries may abuse BITS jobs for persistence, execution, or data transfer, and using PowerShell to create these jobs is a common method.
Detects new BITS transfer job where the LocalName/Saved file is stored in a potentially suspicious location, such as Desktop, C:\Users\Public\, or C:\PerfLogs\.
Page 8 of 9