BITS Jobs T1197
Tactics: Stealth, Persistence, Execution
Adversaries may abuse BITS jobs to persistently execute code and perform various background tasks. Windows Background Intelligent Transfer Service (BITS) is a low-bandwidth, asynchronous file transfer mechanism exposed through Component Object Model (COM). BITS is commonly used by updaters, messengers, and other applications preferred to operate in the background (using available idle bandwidth) without interrupting other networked applications. File transfer tasks are implemented as BITS jobs, which contain a queue of one or more file operations.
Events covered
10 catalog events are tagged with this technique by at least one rule.
| Provider | Event | Title |
|---|---|---|
| Sysmon | Event ID 1 | Process creation |
| Sysmon | Event ID 7 | Image loaded |
| Security-Auditing | Event ID 4688 | A new process has been created. |
| Defender-DeviceProcessEvents | any | Process activity |
| Bits-Client | Event ID 3 | The BITS service created a new job: jobTitle, with owner jobId. |
| Bits-Client | Event ID 60 | BITS stopped transferring the name transfer job that is associated with the url URL. |
| Bits-Client | Event ID 16403 | task_016403 |
| PowerShell | Event ID 4103 | Payload Context: ContextInfo User Data: UserData. |
| PowerShell | Event ID 4104 | Creating Scriptblock text (MessageNumber of MessageTotal). |
| PowerShell | Event ID 800 | Event ID 800 |
Authoring guide
These 39 rules share fields, values, and exclusions.
Fields filtered most (29 distinct)
These fields appear most often in rule filters.
Top indicator values (446 distinct)
These values appear most often in rule predicates.
Exclusions (139 distinct)
These values appear most often in top-level exclusions.
Rules under this technique
These vendors publish rules tagged with this technique.
Sigma 19 rules
- BITS Client BitsProxy DLL Loaded By Uncommon Process
- BITS payload downloaded via commandline
- BITS payload downloaded via PowerShell
- BITS Transfer Job Download From Direct IP
- BITS Transfer Job Download From File Sharing Domains
- BITS Transfer Job Download To Potential Suspicious Folder
- BITS Transfer Job Downloading File Potential Suspicious Extension
- BITS Transfer Job With Uncommon Or Suspicious Remote TLD
- Bitsadmin to Uncommon IP Server Address
- Bitsadmin to Uncommon TLD
- File Download Via Bitsadmin
- File Download Via Bitsadmin To A Suspicious Target Folder
- File with high volume downloaded via BITS
- File With Suspicious Extension Downloaded Via Bitsadmin
- Monitoring For Persistence Via BITS
- New BITS Job Created Via Bitsadmin
- New BITS Job Created Via PowerShell
- Suspicious Download From Direct IP Via Bitsadmin
- Suspicious Download From File-Sharing Website Via Bitsadmin
Elastic 8 rules
- Bitsadmin Activity
- Execution of a Windows Script Downloaded via a LOLBIN
- Ingress Transfer via Windows BITS
- Persistence via BITS Job Notify Cmdline
- Persistence via BITS SetNotifyCmdLine Method
- RunDLL32/Regsvr32 Loads a DLL Downloaded via BITS
- Suspicious Bitsadmin Activity
- Unsigned BITS Service Client Process
Splunk 11 rules
- BITS Job Persistence
- BITSAdmin Download File
- BITSadmin Execution (PowerShell)
- BITSadmin Execution (Sysmon)
- BITSadmin Execution (Windows Event Log)
- BitsAdmin NetCat PowerCat File Transfer (PowerShell)
- BitsAdmin NetCat PowerCat File Transfer (Sysmon)
- BitsAdmin NetCat PowerCat File Transfer (Windows Event Log)
- Cisco NVM - Curl Execution With Insecure Flags
- Cisco NVM - Suspicious Download From File Sharing Website
- PowerShell Start-BitsTransfer