Microsoft BITS Proxy Requests to Uncommon Server IP Hosts

ATT&CK techniques

Execution → C2

Recon
Resource Dev
Initial Access
Execution
- T1197BITS Jobs
Persistence
- T1197BITS Jobs
Priv Esc
Defense Evasion
- T1197BITS Jobs
Cred Access
Discovery
Lateral Movement
Collection
C2
- T1071.001Web Protocols
Exfiltration
Impact

What it detects

This rule flags proxy traffic where the user agent indicates Microsoft BITS and the destination host ends with a single-digit value (1–9) rather than an FQDN. Using an IP-based or atypical host format for BITS transfers can help attackers blend in or avoid straightforward domain-based detections. It relies on proxy telemetry fields for the HTTP user agent and the requested host value.

Reporting behind it

Related detections9 linkedT1071.001 — drag to rearrange

Microsoft BITS Proxy Activity to Uncommon Top-Level Domains

Malicious HarborWatch RAT Command and Control Beacon by User Agent (via proxy)

Suspicious Remote Script Transfer via Bitsadmin (via process_creation)

Suspicious UAT-10608 Credential Harvesting C2 Beacon via HTTP

Malicious BadIIS C2 Communication via lwxatisme User-Agent

Possible PS1Bot C2 Beacon With Drive Serial URI Pattern (via proxy)

Suspicious WarmCookie C2 Beacon With Fixed Firefox User-Agent

Malicious Renamed Python Interpreter Executing nvidia.py RAT

Suspicious File Download Via Bitsadmin Transfer

Microsoft BITS Proxy Requests to Uncommon Server IP Hosts

Pivot detection · T1071.001 · 9 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

microsoft-bits-proxy-traffic-to-ip-like-hostnames-uncommon-server-address-8ccd35a2

title: Microsoft BITS Proxy Requests to Uncommon Server IP Hosts
id: 66e4a92d-0d5d-408b-892a-c98ff39d2444
status: test
description: This rule flags proxy traffic where the user agent indicates Microsoft BITS and the destination host ends with a single-digit value (1–9) rather than an FQDN. Using an IP-based or atypical host format for BITS transfers can help attackers blend in or avoid straightforward domain-based detections. It relies on proxy telemetry fields for the HTTP user agent and the requested host value.
references:
  - https://isc.sans.edu/diary/Microsoft+BITS+Used+to+Download+Payloads/21027
  - https://github.com/SigmaHQ/sigma/blob/master/rules/web/proxy_generic/proxy_ua_bitsadmin_susp_ip.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-06-10
modified: 2022-08-24
tags:
  - attack.command-and-control
  - attack.execution
  - attack.stealth
  - attack.t1071.001
  - attack.persistence
  - attack.t1197
  - attack.s0190
logsource:
  category: proxy
detection:
  selection:
    c-useragent|startswith: Microsoft BITS/
    cs-host|endswith:
      - "1"
      - "2"
      - "3"
      - "4"
      - "5"
      - "6"
      - "7"
      - "8"
      - "9"
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 8ccd35a2-1c7c-468b-b568-ac6cdf80eec3
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL