huntrule

Windows BITS Client Downloads From File-Sharing Domains

Alerts on Windows BITS transfers (EventID 16403) that download from known file-sharing/content hosting domains.

FreeReviewedSigma · High · v2
Product
windows
Service
bits-client
Author
Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2022-06-28
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Execution → Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule identifies Windows BITS client activity where a BITS transfer job downloads a file from a remote name associated with common file-sharing or hosting domains. Attackers can abuse BITS to stealthily retrieve payloads or scripts while blending into legitimate background download behavior. The detection relies on BITS client telemetry recording EventID 16403 along with the remote host name matched against a set of known domain patterns.

Reporting behind it

Related detections9 linkedT1197 — drag to rearrange
Suspicious Backup Exec Remote Agent Spawning Command Shell via Process Creation (via process_creation)
Suspicious BITSAdmin File Transfer Into ProgramData via Process Creation (via process_creation)
Suspicious File Download via bitsadmin Transfer by Medusa Ransomware
Suspicious bitsadmin Download of Python Payload via COLDRIVER
Suspicious Data Transfer via bitsadmin over HTTP
Suspicious SCMBanker Toolkit Staging via Bitsadmin to Public Directory
Suspicious PowerShell BITS Transfer of DLL Payload via process_creation
Suspicious DLL Download to ProgramData via Start-BitsTransfer (via process_creation)
Suspicious Remote Script Transfer via Bitsadmin (via process_creation)
Windows BITS Client Downloads From File-Sharing Domains
Pivot detection · T1197 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.