Ingress Transfer via Windows BITS

edit

Identifies downloads of executable and archive files via the Windows Background Intelligent Transfer Service (BITS). Adversaries could leverage Windows BITS transfer jobs to download remote payloads.

Rule type: eql

Rule indices:

  • logs-endpoint.events.*

Severity: low

Risk score: 21

Runs every: 5m

Searches indices from: now-9m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

Tags:

  • Elastic
  • Host
  • Windows
  • Threat Detection
  • Defense Evasion
  • Command and Control

Version: 1

Rule authors:

  • Elastic

Rule license: Elastic License v2

Rule query

edit
file where event.action == "rename" and

process.name : "svchost.exe" and file.Ext.original.name : "BIT*.tmp" and
 (file.extension :("exe", "zip", "rar", "bat", "dll", "ps1", "vbs", "wsh", "js", "vbe", "pif", "scr", "cmd", "cpl") or file.Ext.header_bytes : "4d5a*") and

 /* noisy paths, for hunting purposes you can use the same query without the following exclusions */
 not file.path : ("?:\\Program Files\\*", "?:\\Program Files (x86)\\*", "?:\\Windows\\*", "?:\\ProgramData\\*\\*") and

 /* lot of third party SW use BITS to download executables with a long file name */
 not length(file.name) > 30

Framework: MITRE ATT&CKTM