Sigma rule: Bitsadmin to Uncommon TLD

Rule

Title

Bitsadmin to Uncommon TLD

Status

test

Level

high

Author

Florian Roth (Nextron Systems), Tim Shelton

Date

2019-03-07

Modified

2026-09-30

File

rules/web/proxy_generic/proxy_ua_bitsadmin_susp_tld.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects Bitsadmin connections to domains with uncommon TLDs

Log source

category

proxy

Detection

selection:
    c-useragent|startswith: 'Microsoft BITS/'
filter_main_legit_tlds:
    cs-host|endswith:
        - '.com'
        - '.microsoft' # Microsoft brand TLD
        - '.net'
        - '.org'
        - '.scdn.co' # spotify streaming
        - '.sfx.ms' # Microsoft domain, example request: https://oneclient.sfx.ms/PreSignInSettings/Prod/2022-08-15-21-xx-xx/PreSignInSettingsConfig.json
condition: selection and not 1 of filter_main_*

False positives (as the rule lists them)

• Rare programs that use Bitsadmin and update from regional TLDs e.g. .uk or .ca

Tags

• attack.command-and-control
• attack.execution
• attack.stealth
• attack.t1071.001
• attack.persistence
• attack.t1197
• attack.s0190

MITRE ATT&CK ids this rule names

• S0190
• T1071.001
• T1197

References

• https://twitter.com/jhencinski/status/1102695118455349248
• https://isc.sans.edu/forums/diary/Investigating+Microsoft+BITS+Activity/23281/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/web/proxy_generic/proxy_ua_bitsadmin_susp_tld.yml