Important Detection 2026 – BITSAdmin Payload Download to Suspicious Path
Detects the use of BITSAdmin or PowerShell 'Start-BitsTransfer' to download files from non-reputable/non-Microsoft sources to suspicious directories such as Temp, AppData, or ProgramData, which is a common technique for ingress tool transfer during malware delivery.
Cortex XDR
