Kanan Hatamov
@hatamovkananBakuCompletionist
0 followers0 downloads1 copy0 likes23 views
2 detections
Filters
Last updated
All Time
Detection languages
2
Categories
1
1
1
1
1
Platforms
2
Products / Services
1
MITRE Techniques
1
1
1
1
1
Detects the abuse of Windows Background Intelligent Transfer Service (BITS) using either bitsadmin.exe or PowerShell's Start-BitsTransfer cmdlet to download files to suspicious directories such as AppData, Temp, or ProgramData, excluding common trusted domains.
An attacker who controls a centralized execution channel (GPO, script, scheduled task, management tool) can disable the built-in Administrator account on many hosts within a short time.