Cross-source coverage
T1197 / ATT&CK
BITS Jobs
35 rules · 34 families across 6 sources.
Showing deprecated rules · back to the default
From MITRE ATT&CK 19.2
Adversaries may abuse BITS jobs to persistently execute code and perform various background tasks. Windows Background Intelligent Transfer Service (BITS) is a low-bandwidth, asynchronous file transfer mechanism exposed through Component Object Model (COM). BITS is commonly used by updaters, messengers, and other applications preferred to operate in the background (using available idle bandwidth) without interrupting other networked applications. File transfer tasks are implemented as BITS jobs, which contain a queue of one or more file operations.
The interface to create and manage BITS jobs is accessible through PowerShell and the BITSAdmin tool.
Adversaries may abuse BITS to download (e.g. Ingress Tool Transfer), execute, and even clean up after running malicious code (e.g. Indicator Removal). BITS tasks are self-contained in the BITS job database, without new files or registry modifications, and often permitted by host firewalls. BITS enabled execution may also enable persistence by creating long-standing jobs (the default maximum lifetime is 90 days and extendable) or invoking an arbitrary program when a job completes or errors (including after system reboots).
BITS upload functionalities can also be used to perform Exfiltration Over Alternative Protocol.
- Tactics
- Stealth · Persistence · Execution
- Platforms
- Windows
- Telemetry
-
WinEventLog:SecurityWinEventLog:SysmonWinEventLog:PowerShellWinEventLog:System
How MITRE says to detect it DET0098
Detect abuse of Windows BITS Jobs for download, execution and persistence
Windows Analytic 0274
Behavioral chain: (1) An actor creates or modifies a BITS job via bitsadmin.exe, PowerShell BITS cmdlets, or COM; (2) the job performs HTTP(S)/SMB network transfers while the owning user is logged on; (3) upon job completion/error, BITS launches a notify command (SetNotifyCmdLine) from svchost.exe -k netsvcs -s BITS, often establishing persistence by keeping long-lived jobs. The strategy correlates process creation, command/script telemetry, BITS-Client operational events, and network connections initiated by BITS.
WinEventLog:SecurityEventCode=4688WinEventLog:SysmonEventCode=3, 22WinEventLog:PowerShellEventCode=4103, 4104, 4105, 4106WinEventLog:SystemEventCode=7036
SigmaHQ/sigma
16 rules| Detection | Severity | Format |
|---|---|---|
| Bitsadmin to Uncommon IP Server Address | High | Sigma |
| Bitsadmin to Uncommon TLD | High | Sigma |
| BITS Transfer Job Download From Direct IP | High | Sigma |
| BITS Transfer Job Download From File Sharing Domains | High | Sigma |
| BITS Transfer Job Download To Potential Suspicious Folder | High | Sigma |
| File Download Via Bitsadmin To A Suspicious Target Folder | High | Sigma |
| File With Suspicious Extension Downloaded Via Bitsadmin | High | Sigma |
| Suspicious Download From Direct IP Via Bitsadmin | High | Sigma |
| Suspicious Download From File-Sharing Website Via Bitsadmin | High | Sigma |
| BITS Transfer Job Downloading File Potential Suspicious Extension | Medium | Sigma |
+ 6 more from SigmaHQ/sigma → showing the 10 highest-severity
socfortress/Wazuh-Rules
5 rules · 4 families| Detection | Severity | Format |
|---|---|---|
| Powershell script: Start-BitsTransfer detected (BITS job abuse) | High | Wazuh XML |
| Sysmon - Event 1: Process creation · BITS Jobs (T1197) 2 variants | Low | Wazuh XML |
| Sysmon - Event 1: Process creation · BITS Jobs (T1197) 2 variants | Low | Wazuh XML |
| Sysmon - Event 3: Network connection by · BITS Jobs (T1197) | Low | Wazuh XML |
| Sysmon - Event 7: Image loaded by · BITS (T1197) | Low | Wazuh XML |
splunk/security_content
5 rules| Detection | Severity | Format |
|---|---|---|
| BITSAdmin Download File | Undefined | SPL |
| BITS Job Persistence | Undefined | SPL |
| Cisco NVM - Curl Execution With Insecure Flags | Undefined | SPL |
| Cisco NVM - Suspicious Download From File Sharing Website | Undefined | SPL |
| PowerShell Start-BitsTransfer | Undefined | SPL |
elastic/protections-artifacts
4 rules| Detection | Severity | Format |
|---|---|---|
| Execution of a Windows Script Downloaded via a LOLBIN | Undefined | Elastic TOML |
| Persistence via BITS SetNotifyCmdLine Method | Undefined | Elastic TOML |
| RunDLL32/Regsvr32 Loads a DLL Downloaded via BITS | Undefined | Elastic TOML |
| Suspicious Bitsadmin Activity | Undefined | Elastic TOML |
chronicle/detection-rules
3 rules| Detection | Severity | Format |
|---|---|---|
| bitsadmin_download | Undefined | YARA-L |
| bits_http_client_useragent_usage | Undefined | YARA-L |
| nemty_ransomware_lolbins_abuse | Undefined | YARA-L |
elastic/detection-rules
2 rules| Detection | Severity | Format |
|---|---|---|
| Persistence via BITS Job Notify Cmdline | Medium | Elastic TOML |
| Ingress Transfer via Windows BITS | Low | Elastic TOML |