Suspicious Download From File-Sharing Website Via Bitsadmin — Detection Rule

Detects usage of bitsadmin downloading a file from a suspicious domain

Read the full analysis on IntelFusions