Windows Process Creation: Bitsadmin Download Using Direct IP URL

title: "Windows Process Creation: Bitsadmin Download Using Direct IP URL"
id: 6a6d5848-923f-49d6-9ce8-1a0934369361
related:
  - id: 90f138c1-f578-4ac3-8c49-eecfd847c8b7
    type: similar
  - id: 99c840f2-2012-46fd-9141-c761987550ef
    type: derived
status: test
description: This rule flags Windows executions of bitsadmin.exe where the command line includes transfer/create/addfile flags and the download URL contains an IP address (e.g., ://1 through ://9). Direct-IP URLs are commonly used to bypass domain-based controls and can indicate staging or stealthy retrieval of payloads. It relies on process creation telemetry, specifically the image/filename and the full command line arguments.
references:
  - https://blog.netspi.com/15-ways-to-download-a-file/#bitsadmin
  - https://isc.sans.edu/diary/22264
  - https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/
  - https://blog.talosintelligence.com/breaking-the-silence-recent-truebot-activity/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_bitsadmin_download_direct_ip.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-06-28
modified: 2023-02-15
tags:
  - attack.persistence
  - attack.execution
  - attack.stealth
  - attack.t1197
  - attack.s0190
  - attack.t1036.003
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \bitsadmin.exe
    - OriginalFileName: bitsadmin.exe
  selection_flags:
    CommandLine|contains:
      - " /transfer "
      - " /create "
      - " /addfile "
  selection_extension:
    CommandLine|contains:
      - ://1
      - ://2
      - ://3
      - ://4
      - ://5
      - ://6
      - ://7
      - ://8
      - ://9
  filter_seven_zip:
    CommandLine|contains: ://7-
  condition: all of selection_* and not 1 of filter_*
falsepositives:
  - Unknown
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_bitsadmin_download_direct_ip/info.yml
license: DRL-1.1