huntrule

Windows Uncommon Process Loads BitsProxy.dll via Image Load

Alert on image loads of BitsProxy.dll by processes outside an allowlist of common Windows BITS-related executables.

FreeUnreviewedSigmalowv1
title: Windows Uncommon Process Loads BitsProxy.dll via Image Load
id: 968afe67-4420-4aad-974d-1fa47090ceda
status: experimental
description: This rule flags image load events where BitsProxy.dll is loaded by a process other than a small set of known Windows binaries commonly associated with BITS-related activity. Attackers can abuse BITS functionality for stealthy background transfers, so loading this DLL by an unusual process can indicate potentially suspicious usage. The detection relies on Windows image load telemetry that includes the loaded module path and the loading process image path.
references:
  - https://unicornofhunt.com/2025/05/22/When-Unicorns-Go-Quiet-BITS-Jobs-and-the-Art-of-Stealthy-Transfers/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/image_load/image_load_dll_bitsproxy_load_by_uncommon_process.yml
author: UnicornOfHunt, Huntrule Team
date: 2025-06-04
tags:
  - attack.persistence
  - attack.execution
  - attack.stealth
  - attack.t1197
  - detection.threat-hunting
logsource:
  category: image_load
  product: windows
detection:
  selection:
    ImageLoaded|endswith: \BitsProxy.dll
  filter_main_system:
    Image:
      - C:\Windows\System32\aitstatic.exe
      - C:\Windows\System32\bitsadmin.exe
      - C:\Windows\System32\desktopimgdownldr.exe
      - C:\Windows\System32\DeviceEnroller.exe
      - C:\Windows\System32\MDMAppInstaller.exe
      - C:\Windows\System32\ofdeploy.exe
      - C:\Windows\System32\RecoveryDrive.exe
      - C:\Windows\System32\Speech_OneCore\common\SpeechModelDownload.exe
      - C:\Windows\SysWOW64\bitsadmin.exe
      - C:\Windows\SysWOW64\OneDriveSetup.exe
      - C:\Windows\SysWOW64\Speech_OneCore\Common\SpeechModelDownload.exe
  filter_optional_chrome:
    Image: C:\Program Files\Google\Chrome\Application\chrome.exe
  condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
  - Allowed binaries in the environment that do BITS Jobs
level: low
license: DRL-1.1
related:
  - id: e700ff14-1bff-4d1d-9438-738dff5f0466
    type: derived

What it detects

This rule flags image load events where BitsProxy.dll is loaded by a process other than a small set of known Windows binaries commonly associated with BITS-related activity. Attackers can abuse BITS functionality for stealthy background transfers, so loading this DLL by an unusual process can indicate potentially suspicious usage. The detection relies on Windows image load telemetry that includes the loaded module path and the loading process image path.

Known false positives

  • Allowed binaries in the environment that do BITS Jobs

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.