Versions (2)
Version DetailsCurrent
Rev: 4 • Apr 12, 2023, 12:00 PM🐾 - 🚨 Suspicious BITSAdmin HTTP connection - T1105
alert http $HOME_NET any -> any any (msg:"🐾 - 🚨 Suspicious BITSAdmin HTTP connection - T1105"; flow:to_server, stateless; http.header; content:"Microsoft BITS"; fast_pattern; nocase; http.host.raw; content:!"microsoft.com"; endswith; nocase; content:!"office.net"; endswith; nocase; content:!"gvt1.com"; endswith; nocase; content:!"windowsupdate.com"; endswith; nocase; content:!"google.com"; endswith; reference:url,https://www.rapid7.com/blog/post/2023/01/11/increasing-the-sting-of-hive-ransomware/; reference:url,https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/#download; reference:url,https://learn.microsoft.com/en-us/windows/win32/bits/bitsadmin-tool; target:src_ip; metadata:ttack_target Client_and_Server, signature_severity Major, affected_product Windows_XP_Vista_7_8_10_11_Server_32_64_Bit, mitre_tactic_id TA0011, mitre_tactic_name Command_and_Control, mitre_technique_id T1105, mitre_technique_name Ingress_Tool_Transfer, created_at 2023_04_12, updated_at 2024_08_01; sid:3300116; rev:4; classtype:policy-violation;)
Apr 12, 2023, 12:00 PM
Aug 1, 2024, 12:00 PM
Feb 21, 2024, 4:00 PM
May 29, 2025, 11:12 PM
rules/PAW-PATRULES_VULN.rules