Bitsadmin to Uncommon IP Server Address — Detection Rule

Detects Bitsadmin connections to IP addresses instead of FQDN names

Read the full analysis on IntelFusions