Windows BITS Client Job Downloads From Uncommon Remote TLDs

Alerts on BITS transfers (EventID 16403) to remote domains with uncommon or suspicious TLD patterns.

FreeReviewedSigma · Medium · v2

Product: windows
Service: bits-client
Author: Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2022-06-10
Updated: 2026-07-31

ATT&CK techniques

Execution → Defense Evasion

Recon
Resource Dev
Initial Access
Execution
- T1197BITS Jobs
Persistence
- T1197BITS Jobs
Priv Esc
Defense Evasion
- T1197BITS Jobs
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies BITS client activity (EventID 16403) where the remote FQDN for a BITS transfer uses a domain suffix that is uncommon or not in a small allowlist. Attackers can use BITS jobs to stage content or perform follow-on actions while blending into normal Windows background transfer behavior. The detection relies on Windows BITS-Client telemetry that records the remote destination (RemoteName) associated with the transfer event.

Reporting behind it

Related detections9 linkedT1197 — drag to rearrange

Suspicious Backup Exec Remote Agent Spawning Command Shell via Process Creation (via process_creation)

Suspicious BITSAdmin File Transfer Into ProgramData via Process Creation (via process_creation)

Suspicious File Download via bitsadmin Transfer by Medusa Ransomware

Suspicious bitsadmin Download of Python Payload via COLDRIVER

Suspicious Data Transfer via bitsadmin over HTTP

Suspicious SCMBanker Toolkit Staging via Bitsadmin to Public Directory

Suspicious PowerShell BITS Transfer of DLL Payload via process_creation

Suspicious DLL Download to ProgramData via Start-BitsTransfer (via process_creation)

Suspicious Remote Script Transfer via Bitsadmin (via process_creation)

Windows BITS Client Job Downloads From Uncommon Remote TLDs

Pivot detection · T1197 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-bits-transfer-job-using-uncommon-or-suspicious-remote-domain-6d44fb93

title: Windows BITS Client Job Downloads From Uncommon Remote TLDs
id: ba394077-49fa-4ddb-af6e-c133f413501a
status: test
description: This rule identifies BITS client activity (EventID 16403) where the remote FQDN for a BITS transfer uses a domain suffix that is uncommon or not in a small allowlist. Attackers can use BITS jobs to stage content or perform follow-on actions while blending into normal Windows background transfer behavior. The detection relies on Windows BITS-Client telemetry that records the remote destination (RemoteName) associated with the transfer event.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1197/T1197.md
  - https://twitter.com/malmoeb/status/1535142803075960832
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/bits_client/win_bits_client_new_transfer_via_uncommon_tld.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-06-10
modified: 2025-02-28
tags:
  - attack.persistence
  - attack.execution
  - attack.stealth
  - attack.t1197
logsource:
  product: windows
  service: bits-client
detection:
  selection:
    EventID: 16403
  filter_main_generic:
    RemoteName|contains:
      - .azureedge.net/
      - .com/
      - .sfx.ms/
      - download.mozilla.org/
      - cdn.onenote.net/
      - cdn.office.net/
      - tscdn.m365.static.microsoft/
  condition: selection and not 1 of filter_main_*
falsepositives:
  - This rule doesn't exclude other known TLDs such as ".org" or ".net". It's recommended to apply additional filters for software and scripts that leverage the BITS service
level: medium
license: DRL-1.1
related:
  - id: 6d44fb93-e7d2-475c-9d3d-54c9c1e33427
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL