Suspicious Download From File-Sharing Website Via Bitsadmin

{
  "process_creation": {
    "EventID": 4688,
    "Channel": "Security"
  },
  "selection_img": [
    {
      "NewProcessName
| endswith": "\\bitsadmin.exe"
    },
    {
      "OriginalFileName": "bitsadmin.exe"
    }
  ],
  "selection_flags": {
    "CommandLine
| contains": [
      " /transfer ",
      " /create ",
      " /addfile "
    ]
  },
  "selection_domain": {
    "CommandLine
| contains": [
      ".githubusercontent.com",
      "0x0.st",
      "anonfiles.com",
      "bashupload.com",
      "cdn.discordapp.com",
      "chunk.io",
      "ddns.net",
      "dl.dropboxusercontent.com",
      "ghostbin.co",
      "github.com",
      "glitch.me",
      "gofile.io",
      "hastebin.com",
      "mediafire.com",
      "mega.nz",
      "onrender.com",
      "pages.dev",
      "paste.ee",
      "pastebin.com",
      "pastebin.pl",
      "pastetext.net",
      "privatlab.com",
      "privatlab.net",
      "send.exploit.in",
      "sendspace.com",
      "storage.googleapis.com",
      "storjshare.io",
      "supabase.co",
      "temp.sh",
      "transfer.sh",
      "trycloudflare.com",
      "ufile.io",
      "w3spaces.com",
      "workers.dev",
      "x0.at"
    ]
  },
  "condition": "process_creation and (all of selection_*)"
}

False Positives

• ⚠ Some legitimate apps use this, but limited.