Microsoft BITS Proxy Requests to Uncommon Top-Level Domains
Flags Microsoft BITS-initiated proxy requests to domains using uncommon TLDs.
- Category
- proxy
- Author
- Florian Roth (Nextron Systems), Tim Shelton (SigmaHQ), DRL 1.1
- Published
- 2019-03-07
- Updated
- 2026-10-03
ATT&CK techniques
Execution → C2Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
This rule flags proxy traffic where the user agent starts with "Microsoft BITS/" and the destination host ends with a top-level domain not in a small allowlist of common TLDs. Attackers can use BITS to stealthily retrieve remote content for command-and-control or persistence, so domain selection anomalies can be an effective signal. It relies on proxy logs that capture the HTTP user agent and the requested host/domain.
Reporting behind it
Changelog
v4- v4Candidate ingested via manual entry.2026-10-03
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Microsoft BITS Proxy Requests to Uncommon Top-Level Domains
id: 289add96-f6df-4cbd-8221-a8f8e0d3657a
status: test
description: This rule flags proxy traffic where the user agent starts with "Microsoft BITS/" and the destination host ends with a top-level domain not in a small allowlist of common TLDs. Attackers can use BITS to stealthily retrieve remote content for command-and-control or persistence, so domain selection anomalies can be an effective signal. It relies on proxy logs that capture the HTTP user agent and the requested host/domain.
references:
- https://twitter.com/jhencinski/status/1102695118455349248
- https://isc.sans.edu/forums/diary/Investigating+Microsoft+BITS+Activity/23281/
- https://github.com/SigmaHQ/sigma/blob/master/rules/web/proxy_generic/proxy_ua_bitsadmin_susp_tld.yml
author: Florian Roth (Nextron Systems), Tim Shelton, Huntrule Team
date: 2019-03-07
modified: 2026-09-30
tags:
- attack.command-and-control
- attack.execution
- attack.stealth
- attack.t1071.001
- attack.persistence
- attack.t1197
- attack.s0190
logsource:
category: proxy
detection:
selection:
c-useragent|startswith: Microsoft BITS/
filter_main_legit_tlds:
cs-host|endswith:
- .com
- .microsoft
- .net
- .org
- .scdn.co
- .sfx.ms
condition: selection and not 1 of filter_main_*
falsepositives:
- Rare programs that use Bitsadmin and update from regional TLDs e.g. .uk or .ca
level: high
license: DRL-1.1
related:
- id: 9eb68894-7476-4cd6-8752-23b51f5883a7
type: derived