Bitsadmin to Uncommon IP Server Address

Title: Bitsadmin to Uncommon IP Server Address
Status: test
Description:Detects Bitsadmin connections to IP addresses instead of FQDN names
References:
  -https://isc.sans.edu/diary/Microsoft+BITS+Used+to+Download+Payloads/21027
Author: Florian Roth (Nextron Systems)
Date: 2022-06-10
modified:2022-08-24
Tags:

• -'attack.command-and-control'
• -'attack.execution'
• -'attack.stealth'
• -'attack.t1071.001'
• -'attack.persistence'
• -'attack.t1197'
• -'attack.s0190'

Logsource:

• category: proxy

Detection:
  selection:
    c-useragent|startswith: 'Microsoft BITS/'
    cs-host|endswith:
      -'1'
      -'2'
      -'3'
      -'4'
      -'5'
      -'6'
      -'7'
      -'8'
      -'9'

  condition:selection
Falsepositives:
  -Unknown
Level: high