Microsoft BITS Proxy Activity to Uncommon Top-Level Domains

ATT&CK techniques

Execution → C2

Recon
Resource Dev
Initial Access
Execution
- T1197BITS Jobs
Persistence
- T1197BITS Jobs
Priv Esc
Defense Evasion
- T1197BITS Jobs
Cred Access
Discovery
Lateral Movement
Collection
C2
- T1071.001Web Protocols
Exfiltration
Impact

What it detects

This rule identifies outbound proxy traffic where the client user-agent starts with "Microsoft BITS/" and the destination domain uses an uncommon TLD. Attackers can leverage BITS-like network activity to retrieve content for command-and-control or staging while blending into legitimate updater traffic. The detection relies on proxy logs that capture user-agent strings and the requested destination domain/TLD, excluding known common and specified benign domains.

Reporting behind it

Related detections9 linkedT1071.001 — drag to rearrange

Microsoft BITS Proxy Requests to Uncommon Server IP Hosts

Malicious Encrypted Reverse Shell via Netcat and GPG on Linux

Malicious axios NPM Supply Chain C2 Domain Resolution

Suspicious Reverse Shell via Dev TCP or Netcat

Malicious HarborWatch RAT Command and Control Beacon by User Agent (via proxy)

Suspicious Remote Script Transfer via Bitsadmin (via process_creation)

Suspicious UAT-10608 Credential Harvesting C2 Beacon via HTTP

Malicious BadIIS C2 Communication via lwxatisme User-Agent

Possible PS1Bot C2 Beacon With Drive Serial URI Pattern (via proxy)

Microsoft BITS Proxy Activity to Uncommon Top-Level Domains

Pivot detection · T1071.001 · 9 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

microsoft-bits-proxy-requests-to-uncommon-tlds-9eb68894

title: Microsoft BITS Proxy Activity to Uncommon Top-Level Domains
id: 289add96-f6df-4cbd-8221-a8f8e0d3657a
status: test
description: This rule identifies outbound proxy traffic where the client user-agent starts with "Microsoft BITS/" and the destination domain uses an uncommon TLD. Attackers can leverage BITS-like network activity to retrieve content for command-and-control or staging while blending into legitimate updater traffic. The detection relies on proxy logs that capture user-agent strings and the requested destination domain/TLD, excluding known common and specified benign domains.
references:
  - https://twitter.com/jhencinski/status/1102695118455349248
  - https://isc.sans.edu/forums/diary/Investigating+Microsoft+BITS+Activity/23281/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/web/proxy_generic/proxy_ua_bitsadmin_susp_tld.yml
author: Florian Roth (Nextron Systems), Tim Shelton, Huntrule Team
date: 2019-03-07
modified: 2023-05-17
tags:
  - attack.command-and-control
  - attack.execution
  - attack.stealth
  - attack.t1071.001
  - attack.persistence
  - attack.t1197
  - attack.s0190
logsource:
  category: proxy
detection:
  selection:
    c-useragent|startswith: Microsoft BITS/
  falsepositives:
    cs-host|endswith:
      - .com
      - .net
      - .org
      - .scdn.co
      - .sfx.ms
  condition: selection and not falsepositives
falsepositives:
  - Rare programs that use Bitsadmin and update from regional TLDs e.g. .uk or .ca
level: high
license: DRL-1.1
related:
  - id: 9eb68894-7476-4cd6-8752-23b51f5883a7
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL