Microsoft BITS Proxy Requests to Uncommon TLDs

Flags Microsoft BITS-initiated proxy requests to domains using uncommon TLDs.

FreeUnreviewedSigmahighv1

microsoft-bits-proxy-requests-to-uncommon-tlds-9eb68894

title: Microsoft BITS Proxy Requests to Uncommon TLDs
id: 289add96-f6df-4cbd-8221-a8f8e0d3657a
status: test
description: This rule identifies network proxy activity where the User-Agent starts with "Microsoft BITS/", and the destination domain does not end in common top-level domains listed as benign. Attackers often use BITS for stealthy downloads and command-and-control staging, and unusual TLDs can be a useful indicator of suspicious infrastructure. The detection relies on proxy logs that capture the HTTP User-Agent and the requested destination domain or host.
references:
  - https://twitter.com/jhencinski/status/1102695118455349248
  - https://isc.sans.edu/forums/diary/Investigating+Microsoft+BITS+Activity/23281/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/web/proxy_generic/proxy_ua_bitsadmin_susp_tld.yml
author: Florian Roth (Nextron Systems), Tim Shelton, Huntrule Team
date: 2019-03-07
modified: 2023-05-17
tags:
  - attack.command-and-control
  - attack.execution
  - attack.stealth
  - attack.t1071.001
  - attack.persistence
  - attack.t1197
  - attack.s0190
logsource:
  category: proxy
detection:
  selection:
    c-useragent|startswith: Microsoft BITS/
  falsepositives:
    cs-host|endswith:
      - .com
      - .net
      - .org
      - .scdn.co
      - .sfx.ms
  condition: selection and not falsepositives
falsepositives:
  - Rare programs that use Bitsadmin and update from regional TLDs e.g. .uk or .ca
level: high
license: DRL-1.1
related:
  - id: 9eb68894-7476-4cd6-8752-23b51f5883a7
    type: derived

What it detects

This rule identifies network proxy activity where the User-Agent starts with "Microsoft BITS/", and the destination domain does not end in common top-level domains listed as benign. Attackers often use BITS for stealthy downloads and command-and-control staging, and unusual TLDs can be a useful indicator of suspicious infrastructure. The detection relies on proxy logs that capture the HTTP User-Agent and the requested destination domain or host.

Known false positives

Rare programs that use Bitsadmin and update from regional TLDs e.g. .uk or .ca

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.