File Download Via Bitsadmin To A Suspicious Target Folder

Title: File Download Via Bitsadmin To A Suspicious Target Folder
Status: test
Description:Detects usage of bitsadmin downloading a file to a suspicious target folder
References:
  -https://blog.netspi.com/15-ways-to-download-a-file/#bitsadmin
  -https://isc.sans.edu/diary/22264
  -https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/
  -https://blog.talosintelligence.com/breaking-the-silence-recent-truebot-activity/
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
Date: 2022-06-28
modified:2025-12-10
Tags:

• -'attack.persistence'
• -'attack.execution'
• -'attack.stealth'
• -'attack.t1197'
• -'attack.s0190'
• -'attack.t1036.003'
• -'attack.command-and-control'
• -'attack.t1105'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_img:
Image|endswith:'\bitsadmin.exe' OriginalFileName:'bitsadmin.exe'   selection_flags:
    CommandLine|contains:
      -' /transfer '
      -' /create '
      -' /addfile '

  selection_folder:
    CommandLine|contains:
      -':\Perflogs'
      -':\ProgramData\'
      -':\Temp\'
      -':\Users\Public\'
      -':\Windows\'
      -'\$Recycle.Bin\'
      -'\AppData\Local\'
      -'\AppData\Roaming\'
      -'\Contacts\'
      -'\Desktop\'
      -'\Favorites\'
      -'\Favourites\'
      -'\inetpub\wwwroot\'
      -'\Music\'
      -'\Pictures\'
      -'\Start Menu\Programs\Startup\'
      -'\Users\Default\'
      -'\Videos\'
      -'%ProgramData%'
      -'%public%'
      -'%temp%'
      -'%tmp%'

  condition:all of selection_*
Falsepositives:
  -Unknown
Level: high