Hayabusa low experimental sigma

BITS Client BitsProxy DLL Loaded By Uncommon Process

Detects an uncommon process loading the "BitsProxy.dll". This DLL is used when the BITS COM instance or API is used. This detection can be used to hunt for uncommon processes loading this DLL in your environment. Which may indicate potential suspicious activity occurring.

View Source

Detection Logic

{
  "image_load": {
    "EventID": 7,
    "Channel": "Microsoft-Windows-Sysmon/Operational"
  },
  "selection": {
    "ImageLoaded
| endswith": "\\BitsProxy.dll"
  },
  "filter_main_system": {
    "Image": [
      "C:\\Windows\\System32\\aitstatic.exe",
      "C:\\Windows\\System32\\bitsadmin.exe",
      "C:\\Windows\\System32\\desktopimgdownldr.exe",
      "C:\\Windows\\System32\\DeviceEnroller.exe",
      "C:\\Windows\\System32\\MDMAppInstaller.exe",
      "C:\\Windows\\System32\\ofdeploy.exe",
      "C:\\Windows\\System32\\RecoveryDrive.exe",
      "C:\\Windows\\System32\\Speech_OneCore\\common\\SpeechModelDownload.exe",
      "C:\\Windows\\SysWOW64\\bitsadmin.exe",
      "C:\\Windows\\SysWOW64\\OneDriveSetup.exe",
      "C:\\Windows\\SysWOW64\\Speech_OneCore\\Common\\SpeechModelDownload.exe"
    ]
  },
  "filter_optional_chrome": {
    "Image": "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe"
  },
  "condition": "image_load and (selection and not 1 of filter_main_* and not 1 of filter_optional_*)"
}

False Positives

⚠ Allowed binaries in the environment that do BITS Jobs

Field Validations

Loading…

Comments (0)

Loading comments...