Windows BITS Transfer Job Writing Files with Suspicious Executable Extensions

Flags Windows BITS transfers saving local files with high-risk script/executable extensions while excluding common benign patterns.

FreeUnreviewedSigmamediumv1

windows-bits-transfer-job-writing-files-with-suspicious-executable-extensions-b85e5894

title: Windows BITS Transfer Job Writing Files with Suspicious Executable Extensions
id: b7835256-416b-48ee-a38f-ec501c580889
status: test
description: This rule identifies new BITS transfer jobs (BITS-Client EventID 16403) where the local output file name ends with potentially suspicious extensions such as .bat, .dll, .exe, .hta, .ps1, .psd1, .sh, .vbe, or .vbs. Attackers can use BITS to stage or deliver executable/script payloads in a way that blends into normal background transfer activity. The detection relies on Windows BITS-Client telemetry for the job creation event and the LocalName value, excluding optional generic cases based on LocalName and RemoteName patterns.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1197/T1197.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/bits_client/win_bits_client_new_transfer_saving_susp_extensions.yml
author: frack113, Huntrule Team
date: 2022-03-01
modified: 2023-03-27
tags:
  - attack.persistence
  - attack.execution
  - attack.stealth
  - attack.t1197
logsource:
  product: windows
  service: bits-client
detection:
  selection:
    EventID: 16403
    LocalName|endswith:
      - .bat
      - .dll
      - .exe
      - .hta
      - .ps1
      - .psd1
      - .sh
      - .vbe
      - .vbs
  filter_optional_generic:
    LocalName|contains: \AppData\
    RemoteName|contains: .com
  condition: selection and not 1 of filter_optional_*
falsepositives:
  - While the file extensions in question can be suspicious at times. It's best to add filters according to your environment to avoid large amount false positives
level: medium
license: DRL-1.1
related:
  - id: b85e5894-9b19-4d86-8c87-a2f3b81f0521
    type: derived

What it detects

This rule identifies new BITS transfer jobs (BITS-Client EventID 16403) where the local output file name ends with potentially suspicious extensions such as .bat, .dll, .exe, .hta, .ps1, .psd1, .sh, .vbe, or .vbs. Attackers can use BITS to stage or deliver executable/script payloads in a way that blends into normal background transfer activity. The detection relies on Windows BITS-Client telemetry for the job creation event and the LocalName value, excluding optional generic cases based on LocalName and RemoteName patterns.

Known false positives

While the file extensions in question can be suspicious at times. It's best to add filters according to your environment to avoid large amount false positives

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.