Windows BITS Transfer Job Using Uncommon or Suspicious Remote Domain

Alerts on BITS transfers (EventID 16403) to remote domains with uncommon or suspicious TLD patterns.

FreeUnreviewedSigmamediumv1

windows-bits-transfer-job-using-uncommon-or-suspicious-remote-domain-6d44fb93

title: Windows BITS Transfer Job Using Uncommon or Suspicious Remote Domain
id: ba394077-49fa-4ddb-af6e-c133f413501a
status: test
description: This rule flags Windows BITS client activity where a download job targets a remote FQDN containing uncommon or potentially suspicious TLD substrings. Attackers may use BITS jobs to repeatedly transfer and later execute or remove payloads with reduced visibility. The detection relies on BITS-Client telemetry for EventID 16403 and examines the RemoteName field contents for specific remote domain substrings.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1197/T1197.md
  - https://twitter.com/malmoeb/status/1535142803075960832
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/bits_client/win_bits_client_new_transfer_via_uncommon_tld.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-06-10
modified: 2025-02-28
tags:
  - attack.persistence
  - attack.execution
  - attack.stealth
  - attack.t1197
logsource:
  product: windows
  service: bits-client
detection:
  selection:
    EventID: 16403
  filter_main_generic:
    RemoteName|contains:
      - .azureedge.net/
      - .com/
      - .sfx.ms/
      - download.mozilla.org/
      - cdn.onenote.net/
      - cdn.office.net/
      - tscdn.m365.static.microsoft/
  condition: selection and not 1 of filter_main_*
falsepositives:
  - This rule doesn't exclude other known TLDs such as ".org" or ".net". It's recommended to apply additional filters for software and scripts that leverage the BITS service
level: medium
license: DRL-1.1
related:
  - id: 6d44fb93-e7d2-475c-9d3d-54c9c1e33427
    type: derived

What it detects

This rule flags Windows BITS client activity where a download job targets a remote FQDN containing uncommon or potentially suspicious TLD substrings. Attackers may use BITS jobs to repeatedly transfer and later execute or remove payloads with reduced visibility. The detection relies on BITS-Client telemetry for EventID 16403 and examines the RemoteName field contents for specific remote domain substrings.

Known false positives

This rule doesn't exclude other known TLDs such as ".org" or ".net". It's recommended to apply additional filters for software and scripts that leverage the BITS service

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.