Windows Process Loaded BitsProxy.dll via Uncommon Image
Alert on image loads of BitsProxy.dll by processes outside an allowlist of common Windows BITS-related executables.
- Product
- windows
- Category
- image_load
- Author
- UnicornOfHunt (SigmaHQ), DRL 1.1
- Published
- 2025-06-04
- Updated
- 2026-07-31
ATT&CK techniques
Execution → Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags events where an uncommon Windows process loads BitsProxy.dll, a DLL associated with BITS COM instance/API usage. Attackers may use BITS-related components to blend activity with legitimate system behavior, so unexpected process participation is a useful hunting signal. The detection relies on image load telemetry that records the loaded module path ending in \BitsProxy.dll, and it filters out several known legitimate loader binaries and Chrome.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Process Loaded BitsProxy.dll via Uncommon Image
id: 968afe67-4420-4aad-974d-1fa47090ceda
status: experimental
description: This rule flags events where an uncommon Windows process loads BitsProxy.dll, a DLL associated with BITS COM instance/API usage. Attackers may use BITS-related components to blend activity with legitimate system behavior, so unexpected process participation is a useful hunting signal. The detection relies on image load telemetry that records the loaded module path ending in \BitsProxy.dll, and it filters out several known legitimate loader binaries and Chrome.
references:
- https://unicornofhunt.com/2025/05/22/When-Unicorns-Go-Quiet-BITS-Jobs-and-the-Art-of-Stealthy-Transfers/
- https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/image_load/image_load_dll_bitsproxy_load_by_uncommon_process.yml
author: UnicornOfHunt, Huntrule Team
date: 2025-06-04
tags:
- attack.persistence
- attack.execution
- attack.stealth
- attack.t1197
- detection.threat-hunting
logsource:
category: image_load
product: windows
detection:
selection:
ImageLoaded|endswith: \BitsProxy.dll
filter_main_system:
Image:
- C:\Windows\System32\aitstatic.exe
- C:\Windows\System32\bitsadmin.exe
- C:\Windows\System32\desktopimgdownldr.exe
- C:\Windows\System32\DeviceEnroller.exe
- C:\Windows\System32\MDMAppInstaller.exe
- C:\Windows\System32\ofdeploy.exe
- C:\Windows\System32\RecoveryDrive.exe
- C:\Windows\System32\Speech_OneCore\common\SpeechModelDownload.exe
- C:\Windows\SysWOW64\bitsadmin.exe
- C:\Windows\SysWOW64\OneDriveSetup.exe
- C:\Windows\SysWOW64\Speech_OneCore\Common\SpeechModelDownload.exe
filter_optional_chrome:
Image: C:\Program Files\Google\Chrome\Application\chrome.exe
condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
- Allowed binaries in the environment that do BITS Jobs
level: low
license: DRL-1.1
related:
- id: e700ff14-1bff-4d1d-9438-738dff5f0466
type: derived