Adding BITS DLL rule

[unicornofhunt]

Summary of the Pull Request

reference: https://unicornofhunt.com/2025/05/22/When-Unicorns-Go-Quiet-BITS-Jobs-and-the-Art-of-Stealthy-Transfers/

Changelog

new: BITS Client BitsProxy DLL Loaded By Uncommon Process

Example Log Event

<?xml version="1.0"?>
<DataItem type="System.XmlData" time="2025-05-24T06:26:04.7586679-07:00" sourceHealthServiceId="A18FEB8F-23F9-A8C4-0E93-245BABEE7B44">
  <EventData xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
    <Data Name="RuleName">technique_id=T1197,technique_name=BITS</Data>
    <Data Name="UtcTime">2025-05-24 13:26:04.749</Data>
    <Data Name="ProcessGuid">{f4a83506-c8dd-6831-6a0b-000000001100}</Data>
    <Data Name="ProcessId">14356</Data>
    <Data Name="Image">C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe</Data>
    <Data Name="ImageLoaded">C:\Windows\System32\BitsProxy.dll</Data>
    <Data Name="FileVersion">7.8.26100.1882 (WinBuild.160101.0800)</Data>
    <Data Name="Description">Background Intelligent Transfer Service Proxy</Data>
    <Data Name="Product">Microsoft&#xAE; Windows&#xAE; Operating System</Data>
    <Data Name="Company">Microsoft Corporation</Data>
    <Data Name="OriginalFileName">qmgrprxy.dll</Data>
    <Data Name="Hashes">SHA1=DDE59105E322DD0742FD582DE685B98C731B21C0,MD5=FDC8DFDBCFDC7637CEA74CECF9D580AB,SHA256=39B245CD0BF0F27241AAAFBB317AEC0D7D01DBF7750851EEF37BB319255C214D,IMPHASH=E68B2C7E33E04DC8081D5A96FEB7F59A</Data>
    <Data Name="Signed">true</Data>
    <Data Name="Signature">Microsoft Windows</Data>
    <Data Name="SignatureStatus">Valid</Data>
    <Data Name="User">unicorn\unicorn</Data>
  </EventData>
</DataItem>

SigmaHQ Rule Creation Conventions

• If your PR adds new rules, please consider following and applying these conventions

[github-actions]

Welcome @unicornofhunt 👋

It looks like this is your first pull request on the Sigma rules repository!

Please make sure to read the SigmaHQ conventions document to make sure your contribution is adhering to best practices and has all the necessary elements in place for a successful approval.

Thanks again, and welcome to the Sigma community! 😃

[phantinuss]

I just ran the pipeline and there are some format errors. Please have a look and let me know if you need assistance.