File With Suspicious Extension Downloaded Via Bitsadmin

Title: File With Suspicious Extension Downloaded Via Bitsadmin
Status: test
Description:Detects usage of bitsadmin downloading a file with a suspicious extension
References:
  -https://blog.netspi.com/15-ways-to-download-a-file/#bitsadmin
  -https://isc.sans.edu/diary/22264
  -https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
Date: 2022-06-28
modified:2023-05-30
Tags:

• -'attack.persistence'
• -'attack.execution'
• -'attack.stealth'
• -'attack.t1197'
• -'attack.s0190'
• -'attack.t1036.003'
• -'attack.command-and-control'
• -'attack.t1105'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_img:
Image|endswith:'\bitsadmin.exe' OriginalFileName:'bitsadmin.exe'   selection_flags:
    CommandLine|contains:
      -' /transfer '
      -' /create '
      -' /addfile '

  selection_extension:
    CommandLine|contains:
      -'.7z'
      -'.asax'
      -'.ashx'
      -'.asmx'
      -'.asp'
      -'.aspx'
      -'.bat'
      -'.cfm'
      -'.cgi'
      -'.chm'
      -'.cmd'
      -'.dll'
      -'.gif'
      -'.jpeg'
      -'.jpg'
      -'.jsp'
      -'.jspx'
      -'.log'
      -'.png'
      -'.ps1'
      -'.psm1'
      -'.rar'
      -'.scf'
      -'.sct'
      -'.txt'
      -'.vbe'
      -'.vbs'
      -'.war'
      -'.wsf'
      -'.wsh'
      -'.xll'
      -'.zip'

  condition:all of selection_*
Falsepositives:
  -Unknown
Level: high