Suspicious Download From Direct IP Via Bitsadmin

Title: Suspicious Download From Direct IP Via Bitsadmin
Status: test
Description:Detects usage of bitsadmin downloading a file using an URL that contains an IP
References:
  -https://blog.netspi.com/15-ways-to-download-a-file/#bitsadmin
  -https://isc.sans.edu/diary/22264
  -https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/
  -https://blog.talosintelligence.com/breaking-the-silence-recent-truebot-activity/
Author: Florian Roth (Nextron Systems)
Date: 2022-06-28
modified:2023-02-15
Tags:

• -'attack.persistence'
• -'attack.execution'
• -'attack.stealth'
• -'attack.t1197'
• -'attack.s0190'
• -'attack.t1036.003'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_img:
Image|endswith:'\bitsadmin.exe' OriginalFileName:'bitsadmin.exe'   selection_flags:
    CommandLine|contains:
      -' /transfer '
      -' /create '
      -' /addfile '

  selection_extension:
    CommandLine|contains:
      -'://1'
      -'://2'
      -'://3'
      -'://4'
      -'://5'
      -'://6'
      -'://7'
      -'://8'
      -'://9'

  filter_seven_zip:
    CommandLine|contains: '://7-'
  condition:all of selection_* and not 1 of filter_*
Falsepositives:
  -Unknown
Level: high