huntrule

Windows BITSAdmin Downloads from File-Sharing Domains

Alerts on BITSAdmin downloads from popular file-sharing domains when transfer/create/addfile command-line flags are present.

FreeReviewedSigma · High · v2
Product
windows
Category
process_creation
Author
Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2022-06-28
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Execution → C2

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags process creation events where bitsadmin.exe is used with BITS transfer commands and the command line references common file-hosting or paste-style domains. Such behavior matters because attackers can abuse BITS to fetch payloads or staged files over HTTP/hosted content while blending into legitimate Windows tooling. The detection relies on Windows process creation telemetry, including the executable path/name and command-line arguments containing both BITS operation flags and matched domain strings.

Reporting behind it

Related detections9 linkedT1105 — drag to rearrange
Windows Process Creation: bitsadmin Downloads Files to Suspicious Directories
Windows Process Creation: BITSAdmin Downloading File with Suspicious Extension
Windows BITSAdmin File Download via bitsadmin.exe with Transfer/Addfile Arguments
Suspicious Remote Script Transfer via Bitsadmin (via process_creation)
Suspicious File Download Via Bitsadmin Transfer
BITS Payload Downloaded via Commandline (via process_creation)
BITS Payload Downloaded via PowerShell (via powershell)
Suspicious sLoad Payload Download via BITSAdmin LOLBin Transfer (via process_creation)
Suspicious File Download via Certutil URLCache
Windows BITSAdmin Downloads from File-Sharing Domains
Pivot detection · T1105 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.