vee1e/capa-rules
1
0
Fork 0
mirror of https://github.com/vee1e/capa-rules.git synced 2026-09-01 19:07:15 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Update create-bits-job.yml

Browse source
This commit is contained in:
Ryan Xu 2021-08-23 10:55:20 -05:00 • committed by GitHub
parent 9951415d5d
commit 70f2af8563
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 3 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

3
communication/http/client/create-bits-job.yml
View file

@ -6,6 +6,9 @@ rule:
author: "@mr-tz"
description: BITS jobs can be used to download data or achieve persistence (via SetNotifyCmdLine)
scope: function
att&ck:
- Defense Evasion::BITS Jobs [T1197]
- Persistence::BITS Jobs [T1197]
references:
- https://www.fireeye.com/blog/threat-research/2021/03/attacker-use-of-windows-background-intelligent-transfer-service.html
examples: