rules-deprecated/windows/proc_creation_win_powershell_bitsjob.yml

title: Suspicious Bitsadmin Job via PowerShell
id: f67dbfce-93bc-440d-86ad-a95ae8858c90
status: deprecated
description: Detect download by BITS jobs via PowerShell
references:
    - https://eqllib.readthedocs.io/en/latest/analytics/ec5180c9-721a-460f-bddc-27539a284273.html
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1197/T1197.md
author: Endgame, JHasenbusch (ported to sigma for oscd.community)
date: 2018/10/30
modified: 2022/11/21
tags:
    - attack.defense_evasion
    - attack.persistence
    - attack.t1197
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
        CommandLine|contains: 'Start-BitsTransfer'
    condition: selection
fields:
    - ComputerName
    - User
    - CommandLine
falsepositives:
    - Unknown
level: high
Added Atomic Blue Detections Repo 2019-10-28 11:59:49 +01:00			`title: Suspicious Bitsadmin Job via PowerShell`
UUIDs + moved unsupported logic 2019-12-19 23:56:36 +01:00			`id: f67dbfce-93bc-440d-86ad-a95ae8858c90`
fix: deprecate f67dbfce-93bc-440d-86ad-a95ae8858c90 2022-11-21 12:31:01 +01:00			`status: deprecated`
Update win_powershell_bitsjob.yaml 2019-11-11 22:06:57 +03:00			`description: Detect download by BITS jobs via PowerShell`
$frack113$ Change status for old rules 2021-11-27 11:33:14 +01:00			`references:`
Update Ref+Selection 2 2022-07-11 17:48:40 +01:00			`- https://eqllib.readthedocs.io/en/latest/analytics/ec5180c9-721a-460f-bddc-27539a284273.html`
			`- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1197/T1197.md`
$frack113$ order yaml 2022-10-28 15:06:36 +02:00			`author: Endgame, JHasenbusch (ported to sigma for oscd.community)`
Update win_powershell_bitsjob.yaml 2019-11-11 22:06:57 +03:00			`date: 2018/10/30`
$frack113$ Update modified last change 2023-01-02 08:44:46 +01:00			`modified: 2022/11/21`
$frack113$ order yaml 2022-10-28 15:06:36 +02:00			`tags:`
			`- attack.defense_evasion`
			`- attack.persistence`
			`- attack.t1197`
Added Atomic Blue Detections Repo 2019-10-28 11:59:49 +01:00			`logsource:`
Update Ref+Selection 2 2022-07-11 17:48:40 +01:00			`category: process_creation`
			`product: windows`
Added Atomic Blue Detections Repo 2019-10-28 11:59:49 +01:00			`detection:`
Update Ref+Selection 2 2022-07-11 17:48:40 +01:00			`selection:`
New Rules + Update 2022-07-14 17:35:50 +01:00			`Image\|endswith:`
			`- '\powershell.exe'`
			`- '\pwsh.exe'`
Update Ref+Selection 2 2022-07-11 17:48:40 +01:00			`CommandLine\|contains: 'Start-BitsTransfer'`
			`condition: selection`
OSCD QA wave 1 2020-01-11 00:11:27 +01:00			`fields:`
Update Ref+Selection 2 2022-07-11 17:48:40 +01:00			`- ComputerName`
			`- User`
			`- CommandLine`
Added Atomic Blue Detections Repo 2019-10-28 11:59:49 +01:00			`falsepositives:`
Update Ref+Selection 2 2022-07-11 17:48:40 +01:00			`- Unknown`
refactor: increase level to high - BITSADMIN PowerShell combo 2021-12-03 15:48:26 +01:00			`level: high`