Sigma rule: BITS Client BitsProxy DLL Loaded By Uncommon Process

Rule

Title

BITS Client BitsProxy DLL Loaded By Uncommon Process

Status

experimental

Level

low

Author

UnicornOfHunt

Date

2025-06-04

File

rules-threat-hunting/windows/image_load/image_load_dll_bitsproxy_load_by_uncommon_process.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects an uncommon process loading the "BitsProxy.dll". This DLL is used when the BITS COM instance or API is used.
This detection can be used to hunt for uncommon processes loading this DLL in your environment. Which may indicate potential suspicious activity occurring.

Log source

product

windows

category

image_load

Detection

selection:
    ImageLoaded|endswith: '\BitsProxy.dll'
filter_main_system:
    Image:
        - 'C:\Windows\System32\aitstatic.exe'
        - 'C:\Windows\System32\bitsadmin.exe'
        - 'C:\Windows\System32\desktopimgdownldr.exe'
        - 'C:\Windows\System32\DeviceEnroller.exe'
        - 'C:\Windows\System32\MDMAppInstaller.exe'
        - 'C:\Windows\System32\ofdeploy.exe'
        - 'C:\Windows\System32\RecoveryDrive.exe'
        - 'C:\Windows\System32\Speech_OneCore\common\SpeechModelDownload.exe'
        # - 'C:\Windows\System32\svchost.exe' # BITS Service - If you collect CommandLine info. Apply a filter for the specific BITS service.
        - 'C:\Windows\SysWOW64\bitsadmin.exe'
        - 'C:\Windows\SysWOW64\OneDriveSetup.exe'
        - 'C:\Windows\SysWOW64\Speech_OneCore\Common\SpeechModelDownload.exe'
filter_optional_chrome:
    Image: 'C:\Program Files\Google\Chrome\Application\chrome.exe'
condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*

False positives (as the rule lists them)

• Allowed binaries in the environment that do BITS Jobs

Tags

• attack.persistence
• attack.execution
• attack.stealth
• attack.t1197
• detection.threat-hunting

MITRE ATT&CK ids this rule names

• T1197

References

• https://unicornofhunt.com/2025/05/22/When-Unicorns-Go-Quiet-BITS-Jobs-and-the-Art-of-Stealthy-Transfers/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-threat-hunting/windows/image_load/image_load_dll_bitsproxy_load_by_uncommon_process.yml