Windows BITS Client Job Downloads From Uncommon Remote TLDs

Alerts on BITS transfers (EventID 16403) to remote domains with uncommon or suspicious TLD patterns.

FreeReviewedSigma · Medium · v2

Product: windows
Service: bits-client
Author: Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2022-06-10
Updated: 2026-07-31

ATT&CK techniques

Execution → Defense Evasion

Recon
Resource Dev
Initial Access
Execution
- T1197BITS Jobs
Persistence
- T1197BITS Jobs
Priv Esc
Defense Evasion
- T1197BITS Jobs
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies BITS client activity (EventID 16403) where the remote FQDN for a BITS transfer uses a domain suffix that is uncommon or not in a small allowlist. Attackers can use BITS jobs to stage content or perform follow-on actions while blending into normal Windows background transfer behavior. The detection relies on Windows BITS-Client telemetry that records the remote destination (RemoteName) associated with the transfer event.

Reporting behind it

Related detections9 linkedT1197 — drag to rearrange

Suspicious Remote Script Transfer via Bitsadmin (via process_creation)

Suspicious File Download Via Bitsadmin Transfer

Suspicious Executable Download via bitsadmin Transfer (via process_creation)

BITS Job Persistence via Bitsadmin Notify Command (via process_creation)

BITS Payload Downloaded via Commandline (via process_creation)

BITS Payload Downloaded via PowerShell (via powershell)

Malicious mshta.exe Spawning bitsadmin via ClickFix Phantom Meet

Suspicious BITSAdmin File Transfer Download (via process_creation)

Suspicious sLoad Payload Download via BITSAdmin LOLBin Transfer (via process_creation)

Windows BITS Client Job Downloads From Uncommon Remote TLDs

Pivot detection · T1197 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-bits-transfer-job-using-uncommon-or-suspicious-remote-domain-6d44fb93

title: Windows BITS Client Job Downloads From Uncommon Remote TLDs
id: ba394077-49fa-4ddb-af6e-c133f413501a
status: test
description: This rule identifies BITS client activity (EventID 16403) where the remote FQDN for a BITS transfer uses a domain suffix that is uncommon or not in a small allowlist. Attackers can use BITS jobs to stage content or perform follow-on actions while blending into normal Windows background transfer behavior. The detection relies on Windows BITS-Client telemetry that records the remote destination (RemoteName) associated with the transfer event.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1197/T1197.md
  - https://twitter.com/malmoeb/status/1535142803075960832
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/bits_client/win_bits_client_new_transfer_via_uncommon_tld.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-06-10
modified: 2025-02-28
tags:
  - attack.persistence
  - attack.execution
  - attack.stealth
  - attack.t1197
logsource:
  product: windows
  service: bits-client
detection:
  selection:
    EventID: 16403
  filter_main_generic:
    RemoteName|contains:
      - .azureedge.net/
      - .com/
      - .sfx.ms/
      - download.mozilla.org/
      - cdn.onenote.net/
      - cdn.office.net/
      - tscdn.m365.static.microsoft/
  condition: selection and not 1 of filter_main_*
falsepositives:
  - This rule doesn't exclude other known TLDs such as ".org" or ".net". It's recommended to apply additional filters for software and scripts that leverage the BITS service
level: medium
license: DRL-1.1
related:
  - id: 6d44fb93-e7d2-475c-9d3d-54c9c1e33427
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL