Addition to CAR-2021-05-004: BITS Job Persistence

[Daniel Ladouceur]

The purpose of this issue is not to create a new CAR analytic, but add to an existing one (for which I do not see a template).

Specifically, I propose an addition to CAR-2021-05-004: BITS Job Persistence.

The context of BITS abuse that this analytic is oriented toward is the fact that, in addition to pulling files onto a host in a way that is difficult to detect, BITS can also be configured to run an arbitrary executable when a job completes or errors-out; an attacker can therefore create a BITS job which runs malware on completion and, by scheduling this BITS jobs to run regularly, it is possible create a persistence mechanism in this way, ensuring that a given executable is run regularly.

The existing analytic implementation for CAR-2021-05-004 detects the creation of a BITS job using bitsadmin.exe; I think that there is room for improvement here as:

• There are ways to create BITS jobs without the use of bitsadmin.exe (for example, through the use of the PowerShell cmdlet Start-BitsTransfer, so no all BITS jobs creations will be caught by this analytic.
• There are often many legitimate BITS jobs, so this is a somewhat noisy analytic.
• This only detects the creation of a BITS job; it does not indicate whether that BITS job is actually being used for persistence nor the location of the malware if it is.

It is possible instead to directly detect when the completion (or error-ing out) of a BITS job triggers the execution of an executable: when this happens (and only when this happens), the malware is run with the parent command svchost.exe -k netsvcs -p -s BITS.

I therefore propose the following additions to CAR-2021-05-004:

To Data Model References, add the following row:

Object	Action	Field
process	create	parent_command_line

To Implimentations, add the following paragraph:

Pseudocode – detect a BITS job triggering code execution (Pseudocode, CAR native)

processes = search Process:Create
bits_job_triggered_execution = filter processes where (parent_command_line is "svchost.exe -k netsvcs -p -s BITS")
output bits_job_triggered_execution