huntrule

Microsoft BITS Proxy Requests to Uncommon Server IP Hosts

Identifies Microsoft BITS proxy connections where the destination host ends with a single-digit, indicating uncommon IP-style addressing.

FreeReviewedSigma · High · v2
Category
proxy
Author
Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2022-06-10
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Execution → C2

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags proxy traffic where the user agent indicates Microsoft BITS and the destination host ends with a single-digit value (1–9) rather than an FQDN. Using an IP-based or atypical host format for BITS transfers can help attackers blend in or avoid straightforward domain-based detections. It relies on proxy telemetry fields for the HTTP user agent and the requested host value.

Reporting behind it

Related detections9 linkedT1071.001 — drag to rearrange
Microsoft BITS Proxy Requests to Uncommon Top-Level Domains
Possible PlugX and NPS Proxy Command and Control Domain Lookup
Possible Backdoor Mistic Command and Control Domain Lookup
Suspicious Weaver Ant In-Memory Web Shell Marker in Web Request (via webserver)
Malicious BlueNoroff C2 Communication via cur1-agent User-Agent (via proxy)
Possible GammaSteel C2 Using Spoofed iPhone User Agent
Suspicious PolarEdge Backdoor C2 URL with Module and putdata Command (via proxy)
Suspicious Interlock Backdoor C2 Beacon to init1234 Endpoint (via proxy)
Possible FakeBat Loader Payload Download and C2 URI Patterns
Microsoft BITS Proxy Requests to Uncommon Server IP Hosts
Pivot detection · T1071.001 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.