Suspicious Download From Direct IP Via Bitsadmin — Detection Rule

Detects usage of bitsadmin downloading a file using an URL that contains an IP

Read the full analysis on IntelFusions