huntrule

Windows BITS Transfer Jobs Downloading Files with Suspicious Extensions

Flags Windows BITS transfers saving local files with high-risk script/executable extensions while excluding common benign patterns.

FreeReviewedSigma · Medium · v2
Product
windows
Service
bits-client
Author
frack113 (SigmaHQ), DRL 1.1
Published
2022-03-01
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Execution → Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule identifies BITS transfer client activity (EventID 16403) where the job writes a local file ending with high-risk executable or script extensions such as .bat, .dll, .exe, .hta, .ps1, .psd1, .sh, .vbe, and .vbs. Attackers may use BITS to stealthily fetch payloads or staging files that later execute. The rule relies on Windows BITS client telemetry that includes the local destination name and applies an optional exclusion when the destination is under AppData and the remote name contains .com.

Reporting behind it

Related detections9 linkedT1197 — drag to rearrange
Suspicious Backup Exec Remote Agent Spawning Command Shell via Process Creation (via process_creation)
Suspicious BITSAdmin File Transfer Into ProgramData via Process Creation (via process_creation)
Suspicious File Download via bitsadmin Transfer by Medusa Ransomware
Suspicious bitsadmin Download of Python Payload via COLDRIVER
Suspicious Data Transfer via bitsadmin over HTTP
Suspicious SCMBanker Toolkit Staging via Bitsadmin to Public Directory
Suspicious PowerShell BITS Transfer of DLL Payload via process_creation
Suspicious DLL Download to ProgramData via Start-BitsTransfer (via process_creation)
Suspicious Remote Script Transfer via Bitsadmin (via process_creation)
Windows BITS Transfer Jobs Downloading Files with Suspicious Extensions
Pivot detection · T1197 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.