Microsoft BITS Proxy Traffic to IP-Like Hostnames (Uncommon Server Address)

title: Microsoft BITS Proxy Traffic to IP-Like Hostnames (Uncommon Server Address)
id: 66e4a92d-0d5d-408b-892a-c98ff39d2444
status: test
description: This rule flags proxy traffic where the user agent indicates Microsoft BITS and the destination host ends with a single-digit value. Attackers may prefer direct IP addressing over FQDNs to reduce reliance on DNS and blend into infrastructure patterns. It relies on proxy logs capturing the HTTP user agent and the requested host value used by the BITS client.
references:
  - https://isc.sans.edu/diary/Microsoft+BITS+Used+to+Download+Payloads/21027
  - https://github.com/SigmaHQ/sigma/blob/master/rules/web/proxy_generic/proxy_ua_bitsadmin_susp_ip.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-06-10
modified: 2022-08-24
tags:
  - attack.command-and-control
  - attack.execution
  - attack.stealth
  - attack.t1071.001
  - attack.persistence
  - attack.t1197
  - attack.s0190
logsource:
  category: proxy
detection:
  selection:
    c-useragent|startswith: Microsoft BITS/
    cs-host|endswith:
      - "1"
      - "2"
      - "3"
      - "4"
      - "5"
      - "6"
      - "7"
      - "8"
      - "9"
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 8ccd35a2-1c7c-468b-b568-ac6cdf80eec3
    type: derived