huntrule

Windows Process Creation: bitsadmin.exe File Download Activity

Flags bitsadmin.exe being started with parameters consistent with transferring/downloading files from an http URL.

FreeUnreviewedSigmamediumv1
title: "Windows Process Creation: bitsadmin.exe File Download Activity"
id: 29662efb-f11d-4d6d-a419-b1f79b104cad
status: test
description: This rule identifies Windows process creation events where bitsadmin.exe is launched with command-line arguments consistent with downloading a file. Attackers may use BITSAdmin to retrieve external content and blend transfer activity into normal background transfer mechanisms. The detection relies on process creation telemetry, matching the executable name/path and specific command-line parameters such as /transfer, /create, /addfile, and an http URL.
references:
  - https://blog.netspi.com/15-ways-to-download-a-file/#bitsadmin
  - https://isc.sans.edu/diary/22264
  - https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_bitsadmin_download.yml
author: Michael Haag, FPT.EagleEye, Huntrule Team
date: 2017-03-09
modified: 2023-02-15
tags:
  - attack.persistence
  - attack.execution
  - attack.stealth
  - attack.t1197
  - attack.s0190
  - attack.t1036.003
  - attack.command-and-control
  - attack.t1105
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \bitsadmin.exe
    - OriginalFileName: bitsadmin.exe
  selection_cmd:
    CommandLine|contains: " /transfer "
  selection_cli_1:
    CommandLine|contains:
      - " /create "
      - " /addfile "
  selection_cli_2:
    CommandLine|contains: http
  condition: selection_img and (selection_cmd or all of selection_cli_*)
falsepositives:
  - Some legitimate apps use this, but limited.
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_bitsadmin_download/info.yml
simulation:
  - type: atomic-red-team
    name: Windows - BITSAdmin BITS Download
    technique: T1105
    atomic_guid: a1921cd3-9a2d-47d5-a891-f1d0f2a7a31b
license: DRL-1.1
related:
  - id: d059842b-6b9d-4ed1-b5c3-5b89143c6ede
    type: derived

What it detects

This rule identifies Windows process creation events where bitsadmin.exe is launched with command-line arguments consistent with downloading a file. Attackers may use BITSAdmin to retrieve external content and blend transfer activity into normal background transfer mechanisms. The detection relies on process creation telemetry, matching the executable name/path and specific command-line parameters such as /transfer, /create, /addfile, and an http URL.

Known false positives

  • Some legitimate apps use this, but limited.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.