Suspicious File Extensions in BITS Transfer Jobs

Background Intelligent Transfer Service (BITS) is a legitimate Windows component designed for asynchronous, prioritized, and throttled file transfers. Adversaries frequently abuse BITS to download malicious payloads or exfiltrate data, leveraging its ability to bypass certain proxy configurations and maintain persistence across system reboots. This detection focuses on identifying BITS transfer jobs that result in the creation of files with extensions commonly associated with script execution or binary deployment, such as .exe, .dll, .bat, or .ps1. By monitoring the BITS service logs for specific file extensions being written to disk, defenders can identify potential stage-one malware delivery or secondary payload acquisition that might otherwise blend in with legitimate update traffic.

Impact

Successful abuse of BITS for payload delivery can lead to remote code execution, persistence establishment, or data exfiltration. Attackers exploit the trusted nature of the BITS service to download malicious files to sensitive directories, potentially bypassing standard application whitelisting or endpoint protection heuristics that prioritize the BITS process over the underlying payload content.

Recommendation

Deploy the following detection logic to monitor BITS-client event logs for suspicious file write operations. Prior to enabling, tune the exclusions (filters) based on local baselines to account for authorized software update processes, specifically those utilizing standard paths like AppData.

• Deploy the Sigma rule below to track BITS-client Event ID 16403.
• Establish a baseline of legitimate BITS transfers in the environment to refine filtering and reduce false positives.
• Investigate any hits against this rule to confirm if the source (RemoteName) and destination (LocalName) are consistent with expected business operations.