Bitsadmin used to download or execute a file
Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel,
n'hésitez pas à nous contacter.
Goal
Detect when bitsadmin is used to download or execute a file.
Strategy
Threat actors are known to utilize tools found natively in a victim’s environment to accomplish their objectives. Bitsadmin, a legitimate Windows binary, has been abused by malicious actors in the past to fetch additional tools and payloads, as well as execute malicious content.
Triage and response
- Identify what is being downloaded or executed, and determine if authorized
- If it’s not authorized, isolate the host from the network.
- Follow your organization’s internal processes for investigating and remediating compromised systems.
Requires Agent version 7.50.0 or greater.
This rule is a part of the beta for detections on Windows! If you would like to try the new Windows agent, create a support ticket and indicate that you wish to join the Cloud Security Management - Windows beta.
