Tag
high
advisory
Suspicious Download From File-Sharing Website Via Bitsadmin
1 rule 4 TTPs 35 IOCsThis threat brief details the detection of adversaries leveraging the legitimate Windows Background Intelligent Transfer Service (BITSAdmin) utility to download malicious payloads from suspicious file-sharing and cloud storage domains, a technique commonly employed by ransomware groups and APTs for ingress tool transfer and stealthy execution.
living-off-the-land
lolbas
payload-delivery
ingress-tool-transfer
command-and-control
windows
1r
4t
35i
high
advisory
Suspicious CSC.exe Parent Process
3 rules 3 TTPsThe Csc.exe (C# compiler) process is being launched by unusual parent processes or from suspicious locations, indicating potential malware execution or defense evasion.
Windows
attack.execution
attack.defense-evasion
csc.exe
payload-delivery
3r
3t