Bitsadmin to Uncommon TLD

Title: Bitsadmin to Uncommon TLD
Status: test
Description:Detects Bitsadmin connections to domains with uncommon TLDs
References:
  -https://twitter.com/jhencinski/status/1102695118455349248
  -https://isc.sans.edu/forums/diary/Investigating+Microsoft+BITS+Activity/23281/
Author: Florian Roth (Nextron Systems), Tim Shelton
Date: 2019-03-07
modified:2026-09-30
Tags:

• -'attack.command-and-control'
• -'attack.execution'
• -'attack.stealth'
• -'attack.t1071.001'
• -'attack.persistence'
• -'attack.t1197'
• -'attack.s0190'

Logsource:

• category: proxy

Detection:
  selection:
    c-useragent|startswith: 'Microsoft BITS/'
  filter_main_legit_tlds:
    cs-host|endswith:
      -'.com'
      -'.microsoft'
      -'.net'
      -'.org'
      -'.scdn.co'
      -'.sfx.ms'

  condition:selection and not 1 of filter_main_*
Falsepositives:
  -Rare programs that use Bitsadmin and update from regional TLDs e.g. .uk or .ca
Level: high