Sigma rule: BITS Transfer Job Download From Direct IP

Rule

Title

BITS Transfer Job Download From Direct IP

Status

test

Level

high

Author

Nasreddine Bencherchali (Nextron Systems)

Date

2023-01-11

Modified

2023-03-27

File

rules/windows/builtin/bits_client/win_bits_client_new_transfer_via_ip_address.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects a BITS transfer job downloading file(s) from a direct IP address.

Log source

product

windows

service

bits-client

Detection

selection:
    EventID: 16403
    RemoteName|contains:
        - 'http://1'
        - 'http://2'
        - 'http://3'
        - 'http://4'
        - 'http://5'
        - 'http://6'
        - 'http://7'
        - 'http://8'
        - 'http://9'
        - 'https://1'
        - 'https://2'
        - 'https://3'
        - 'https://4'
        - 'https://5'
        - 'https://6'
        - 'https://7'
        - 'https://8'
        - 'https://9'
filter_optional_local_networks:
    RemoteName|contains:
        - '://10.' # 10.0.0.0/8
        - '://192.168.' # 192.168.0.0/16
        - '://172.16.' # 172.16.0.0/12
        - '://172.17.'
        - '://172.18.'
        - '://172.19.'
        - '://172.20.'
        - '://172.21.'
        - '://172.22.'
        - '://172.23.'
        - '://172.24.'
        - '://172.25.'
        - '://172.26.'
        - '://172.27.'
        - '://172.28.'
        - '://172.29.'
        - '://172.30.'
        - '://172.31.'
        - '://127.' # 127.0.0.0/8
        - '://169.254.' # 169.254.0.0/16
filter_optional_seven_zip:
    RemoteName|contains:
        # For https://7-zip.org/
        - 'https://7-'
        - 'http://7-'
condition: selection and not 1 of filter_optional_*

False positives (as the rule lists them)

• Unknown

Tags

• attack.persistence
• attack.execution
• attack.stealth
• attack.t1197

MITRE ATT&CK ids this rule names

• T1197

Related rules

• 99c840f2-2012-46fd-9141-c761987550ef (similar)

References

• https://blog.netspi.com/15-ways-to-download-a-file/#bitsadmin
• https://isc.sans.edu/diary/22264
• https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/
• https://blog.talosintelligence.com/breaking-the-silence-recent-truebot-activity/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/builtin/bits_client/win_bits_client_new_transfer_via_ip_address.yml