huntrule

Windows BITS Client Downloads From File-Sharing Domains

Alerts on Windows BITS transfers (EventID 16403) that download from known file-sharing/content hosting domains.

FreeReviewedSigma · High · v2
Product
windows
Service
bits-client
Author
Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2022-06-28
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Execution → Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule identifies Windows BITS client activity where a BITS transfer job downloads a file from a remote name associated with common file-sharing or hosting domains. Attackers can abuse BITS to stealthily retrieve payloads or scripts while blending into legitimate background download behavior. The detection relies on BITS client telemetry recording EventID 16403 along with the remote host name matched against a set of known domain patterns.

Reporting behind it

Related detections9 linkedT1197 — drag to rearrange
Suspicious Remote Script Transfer via Bitsadmin (via process_creation)
Suspicious File Download Via Bitsadmin Transfer
Suspicious Executable Download via bitsadmin Transfer (via process_creation)
BITS Job Persistence via Bitsadmin Notify Command (via process_creation)
BITS Payload Downloaded via Commandline (via process_creation)
BITS Payload Downloaded via PowerShell (via powershell)
Malicious mshta.exe Spawning bitsadmin via ClickFix Phantom Meet
Suspicious BITSAdmin File Transfer Download (via process_creation)
Suspicious sLoad Payload Download via BITSAdmin LOLBin Transfer (via process_creation)
Windows BITS Client Downloads From File-Sharing Domains
Pivot detection · T1197 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.