File Download Via Bitsadmin To An Uncommon Target Folder

Title: File Download Via Bitsadmin To An Uncommon Target Folder
Status: test
Description:Detects usage of bitsadmin downloading a file to uncommon target folder
References:
  -https://blog.netspi.com/15-ways-to-download-a-file/#bitsadmin
  -https://isc.sans.edu/diary/22264
  -https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/
  -https://blog.talosintelligence.com/breaking-the-silence-recent-truebot-activity/
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
Date: 2022-06-28
modified:2023-02-15
Tags:

• -'attack.defense-evasion'
• -'attack.persistence'
• -'attack.t1197'
• -'attack.s0190'
• -'attack.t1036.003'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_img:
Image|endswith:'\bitsadmin.exe' OriginalFileName:'bitsadmin.exe'   selection_flags:
    CommandLine|contains:
      -' /transfer '
      -' /create '
      -' /addfile '

  selection_folder:
    CommandLine|contains:
      -'%AppData%'
      -'%temp%'
      -'%tmp%'
      -'\AppData\Local\'
      -'C:\Windows\Temp\'

  condition:all of selection_*
Falsepositives:
  -Unknown
Level: medium