Techniques
Sample rules
Bitsadmin to Uncommon TLD
- source: sigma
- technicques:
- t1071
- t1071.001
- t1197
Description
Detects Bitsadmin connections to domains with uncommon TLDs
Detection logic
condition: selection and not 1 of filter_main_*
filter_main_legit_tlds:
cs-host|endswith:
- .com
- .microsoft
- .net
- .org
- .scdn.co
- .sfx.ms
selection:
c-useragent|startswith: Microsoft BITS/