Sigma rule: BITS Transfer Job Downloading File Potential Suspicious Extension

Rule

Title

BITS Transfer Job Downloading File Potential Suspicious Extension

Status

test

Level

medium

Author

frack113

Date

2022-03-01

Modified

2023-03-27

File

rules/windows/builtin/bits_client/win_bits_client_new_transfer_saving_susp_extensions.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects new BITS transfer job saving local files with potential suspicious extensions

Log source

product

windows

service

bits-client

Detection

selection:
    EventID: 16403
    LocalName|endswith:
        # TODO: Extend this list with more interesting file extensions
        - '.bat'
        - '.dll'
        - '.exe' # TODO: Might wanna comment this if it generates tons of FPs
        - '.hta'
        - '.ps1'
        - '.psd1'
        - '.sh'
        - '.vbe'
        - '.vbs'
filter_optional_generic:
    # Typical updates: Chrome, Dropbox etc.
    LocalName|contains: '\AppData\'
    RemoteName|contains: '.com'
condition: selection and not 1 of filter_optional_*

False positives (as the rule lists them)

• While the file extensions in question can be suspicious at times. It's best to add filters according to your environment to avoid large amount false positives

Tags

• attack.persistence
• attack.execution
• attack.stealth
• attack.t1197

MITRE ATT&CK ids this rule names

• T1197

References

• https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1197/T1197.md

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/builtin/bits_client/win_bits_client_new_transfer_saving_susp_extensions.yml