Windows PowerShell Created New BITS Job (Event ID 3)

Flags new BITS job creation on Windows when initiated by PowerShell (Event ID 3).

FreeUnreviewedSigmalowv1

windows-powershell-created-new-bits-job-event-id-3-fe3a2d49

title: Windows PowerShell Created New BITS Job (Event ID 3)
id: 077331a3-b9a7-4dc4-94c2-04d217daacb8
status: test
description: This rule identifies Windows BITS Client events where a new BITS job is created and the triggering process is PowerShell (powershell.exe or pwsh.exe). Creating BITS jobs via PowerShell can be used to stage or persist workloads while blending into normal background transfer behavior. The detection relies on BITS-Client telemetry (Event ID 3) and process path information indicating PowerShell execution.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1197/T1197.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/bits_client/win_bits_client_new_job_via_powershell.yml
author: frack113, Huntrule Team
date: 2022-03-01
modified: 2023-03-27
tags:
  - attack.persistence
  - attack.execution
  - attack.stealth
  - attack.t1197
logsource:
  product: windows
  service: bits-client
detection:
  selection:
    EventID: 3
    processPath|endswith:
      - \powershell.exe
      - \pwsh.exe
  condition: selection
falsepositives:
  - Administrator PowerShell scripts
level: low
license: DRL-1.1
related:
  - id: fe3a2d49-f255-4d10-935c-bda7391108eb
    type: derived

What it detects

This rule identifies Windows BITS Client events where a new BITS job is created and the triggering process is PowerShell (powershell.exe or pwsh.exe). Creating BITS jobs via PowerShell can be used to stage or persist workloads while blending into normal background transfer behavior. The detection relies on BITS-Client telemetry (Event ID 3) and process path information indicating PowerShell execution.

Known false positives

Administrator PowerShell scripts

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.