File Download Via Bitsadmin

Title: File Download Via Bitsadmin
Status: test
Description:Detects usage of bitsadmin downloading a file
References:
  -https://blog.netspi.com/15-ways-to-download-a-file/#bitsadmin
  -https://isc.sans.edu/diary/22264
  -https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/
Author: Michael Haag, FPT.EagleEye
Date: 2017-03-09
modified:2023-02-15
Tags:

• -'attack.persistence'
• -'attack.execution'
• -'attack.stealth'
• -'attack.t1197'
• -'attack.s0190'
• -'attack.t1036.003'
• -'attack.command-and-control'
• -'attack.t1105'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_img:
Image|endswith:'\bitsadmin.exe' OriginalFileName:'bitsadmin.exe'   selection_cmd:
    CommandLine|contains: ' /transfer '
  selection_cli_1:
    CommandLine|contains:
      -' /create '
      -' /addfile '

  selection_cli_2:
    CommandLine|contains: 'http'
  condition:selection_img and (selection_cmd or all of selection_cli_*)
Falsepositives:
  -Some legitimate apps use this, but limited.
Level: medium