BITS Transfer Job Download From File Sharing Domains

Title: BITS Transfer Job Download From File Sharing Domains
Status: test
Description:Detects BITS transfer job downloading files from a file sharing domain.
References:
  -https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1197/T1197.md
  -https://twitter.com/malmoeb/status/1535142803075960832
  -https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/ransomware-hive-conti-avoslocker
  -https://www.microsoft.com/en-us/security/blog/2024/01/17/new-ttps-observed-in-mint-sandstorm-campaign-targeting-high-profile-individuals-at-universities-and-research-orgs/
Author: Florian Roth (Nextron Systems)
Date: 2022-06-28
modified:2026-03-29
Tags:

• -'attack.persistence'
• -'attack.execution'
• -'attack.stealth'
• -'attack.t1197'

Logsource:

• product: windows
• service: bits-client

Detection:
  selection:
    EventID: '16403'
    RemoteName|contains:
      -'.githubusercontent.com'
      -'0x0.st'
      -'anonfiles.com'
      -'bashupload.com'
      -'cdn.discordapp.com'
      -'chunk.io'
      -'ddns.net'
      -'dl.dropboxusercontent.com'
      -'ghostbin.co'
      -'github.com'
      -'glitch.me'
      -'gofile.io'
      -'hastebin.com'
      -'mediafire.com'
      -'mega.nz'
      -'onrender.com'
      -'pages.dev'
      -'paste.ee'
      -'pastebin.com'
      -'pastebin.pl'
      -'pastetext.net'
      -'pixeldrain.com'
      -'privatlab.com'
      -'privatlab.net'
      -'send.exploit.in'
      -'sendspace.com'
      -'storage.googleapis.com'
      -'storjshare.io'
      -'supabase.co'
      -'temp.sh'
      -'transfer.sh'
      -'trycloudflare.com'
      -'ufile.io'
      -'w3spaces.com'
      -'workers.dev'
      -'x0.at'

  condition:selection
Falsepositives:
  -Unknown
Level: high