Monitoring For Persistence Via BITS
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
BITS will allow you to schedule a command to execute after a successful download to notify you that the job is finished. When the job runs on the system the command specified in the BITS job will be executed. This can be abused by actors to create a backdoor within the system and for persistence. It will be chained in a BITS job to schedule the download of malware/additional binaries and execute the program after being downloaded.
Severity
Trouble
Rule Requirement
Criteria
Action1: actionname = "Process started" AND (PROCESSNAME endswith "\bitsadmin.exe" OR ORIGINALFILENAME = "bitsadmin.exe") AND ((COMMANDLINE contains "/SetNotifyCmdLine" AND COMMANDLINE contains "%COMSPEC%,cmd.exe,regsvr32.exe") OR (COMMANDLINE contains "/Addfile" AND COMMANDLINE contains "http:,https:,ftp:,ftps:")) select Action1.HOSTNAME,Action1.MESSAGE,Action1.COMMANDLINE,Action1.FILE_NAME,Action1.PROCESSNAME,Action1.USERNAME,Action1.PARENTPROCESSNAME
Detection
Execution Mode
realtime
Log Sources
Windows
Author
Sreeman
