BITS Jobs T1197

Tactics: Stealth, Persistence, Execution

Adversaries may abuse BITS jobs to persistently execute code and perform various background tasks. Windows Background Intelligent Transfer Service (BITS) is a low-bandwidth, asynchronous file transfer mechanism exposed through Component Object Model (COM). BITS is commonly used by updaters, messengers, and other applications preferred to operate in the background (using available idle bandwidth) without interrupting other networked applications. File transfer tasks are implemented as BITS jobs, which contain a queue of one or more file operations.

Events covered

10 catalog events are tagged with this technique by at least one rule.

Authoring guide

These 39 rules share fields, values, and exclusions.

Fields filtered most (31 distinct)

These fields appear most often in rule filters.

FieldRulesHowSample values
CommandLine15contains 11, in 2, regex_match 2 /addfile , /create , /transfer , *addfile*, /addfile
OriginalFileName13eq 12, in 1bitsadmin.exe, certutil.exe, certreq.exe, cmd.exe, cmstp.exe
Image11ends_with 7, wildcard 2, eq 1, is_not_null 1, starts_with 1\bitsadmin.exe, ?:\programdata\*, ?:\users\, ?:\users\*\appdata\*, ?:\windows\sys*\openssh\sftp.exe
process_name9eq 9, in 1bitsadmin.exe, powershell.exe, svchost.exe, certoc.exe, certutil.exe
EventID4eq 41, 4103, 4104, 4688
EventType4eq 4rename, start
RemoteName4contains 4.azureedge.net/, .com, .com/, .githubusercontent.com, .sfx.ms/
event.type3eq 3start
host.os.type3eq 3
parent_process_name3eq 3svchost.exe, acrord32.exe, chrome.exe, cmd.exe
LocalName2contains 2, ends_with 1.bat, .dll, .exe, \desktop\, c:\perflogs\
c-useragent2starts_with 2Microsoft BITS/
cs-host2ends_with 2.com, .net, .org, 1, 2
file.Ext.header_bytes2starts_with 24d5a
file.Ext.original.name2wildcard 2BIT*.tmp

Top indicator values (440 distinct)

These values appear most often in rule predicates.

FieldKindValueRules (here)Corpus reach
OriginalFileNameeq
bitsadmin.exe
1120
Imageends_with
\bitsadmin.exe
729
CommandLinecontains
/addfile
55
CommandLinecontains
/create
515
CommandLinecontains
/transfer
55
CommandLinecontains
/addfile
22
CommandLinecontains
/transfer
22
CommandLinecontains
download
24
CommandLinecontains
http
252
CommandLinecontains
transfer
23
CommandLinecontains
--output
1
CommandLinecontains
-o
18
CommandLinecontains
%comspec%
16
CommandLinecontains
%programdata%
14
process_nameeq
bitsadmin.exe
423
process_nameeq
svchost.exe
324
process_nameeq
powershell.exe
2184
event.typeeq
start
31078
CommandLinein
*addfile*
22
EventIDeq
1
2241
EventTypeeq
rename
222
EventTypeeq
start
2391
c-useragentstarts_with
Microsoft BITS/
22
file.Ext.header_bytesstarts_with
4d5a
246
file.Ext.original.namewildcard
BIT*.tmp
22
file.extensioneq
cpl
219
file.extensioneq
dll
233
parent_process_nameeq
svchost.exe
219
sourcetypein
cisco:nvm:flowdata
214
sourcetypein
cisco:nvm:flowdata:v2
214

Exclusions (139 distinct)

These values appear most often in top-level exclusions.

FieldKindValueRules excluding
dest_ipin
10.0.0.0/8
2
dest_ipin
127.0.0.0/8
2
dest_ipin
169.254.0.0/16
2
dest_ipin
172.16.0.0/12
2
dest_ipin
192.168.0.0/16
2
dest_ipin
224.0.0.0/4
2
dest_ipin
255.255.255.255
2
dest_ipin
::1
2
dest_ipin
fe80::/10
2
dest_ipin
ff00::/8
2
parent_process_nameeq
cmd.exe
2
process.code_signature.trustedeq
true
2
CommandLinecontains
://7-
1
CommandLineeq
bitsadmin /rawreturn /getbytestransferred mingw
1
CurrentDirectorystarts_with
E:\
1

Rules under this technique

These vendors publish rules tagged with this technique.

Platform (all)
Domain (all)

Sigma 19 rules

Elastic 8 rules

Splunk 11 rules

Kusto 1 rule