{"id":"T1197","name":"BITS Jobs","url":"https://attack.mitre.org/techniques/T1197","tactics":["stealth","persistence","execution"],"platforms":["Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0098","stix_id":"x-mitre-detection-strategy--de9fde27-426b-4cb1-afcd-dbe1f7d4273f","name":"Detect abuse of Windows BITS Jobs for download, execution and persistence","url":"https://attack.mitre.org/detectionstrategies/DET0098","analytics":[{"id":"AN0274","stix_id":"x-mitre-analytic--6fba9520-c6ce-4a8f-8005-d33546a10406","name":"Analytic 0274","description":"Behavioral chain: (1) An actor creates or modifies a BITS job via bitsadmin.exe, PowerShell BITS cmdlets, or COM; (2) the job performs HTTP(S)/SMB network transfers while the owning user is logged on; (3) upon job completion/error, BITS launches a notify command (SetNotifyCmdLine) from svchost.exe -k netsvcs -s BITS, often establishing persistence by keeping long-lived jobs. The strategy correlates process creation, command/script telemetry, BITS-Client operational events, and network connections initiated by BITS.","url":"https://attack.mitre.org/detectionstrategies/DET0098#AN0274","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Security","channel":"EventCode=4688","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-security"},{"name":"WinEventLog:Sysmon","channel":"EventCode=3, 22","data_component":"DC0082","data_component_name":"Network Connection Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:PowerShell","channel":"EventCode=4103, 4104, 4105, 4106","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"wineventlog-powershell"},{"name":"WinEventLog:System","channel":"EventCode=7036","data_component":"DC0060","data_component_name":"Service Creation","log_source_slug":"wineventlog-system"}],"mutable_elements":[{"field":"TimeWindow","description":"Correlation window linking job creation, transfer, and notify execution (e.g., 30m–24h depending on environment and BITS retry behavior)."},{"field":"ExpectedUpdateHosts","description":"Allow-list of corporate update/CDN endpoints that legitimately use BITS (WSUS, MEMCM, vendor updaters)."},{"field":"SuspiciousCliSwitches","description":"BITSAdmin flags of interest (/transfer, /addfile, /SetNotifyCmdLine, /resume, /setcustomheaders, /setminretrydelay)."},{"field":"NotifyCmdBlockList","description":"Known risky binaries or folders (e.g., %TEMP%\\*.exe, powershell.exe, cmd.exe) used as BITS notify commands."},{"field":"UserContext","description":"Scope by interactive users, service accounts, or high-value targets (admins/servers) to reduce benign noise."},{"field":"ExternalNetCIDRs","description":"Definition of external/non-corp destinations for network correlation."},{"field":"JobLifetimeThreshold","description":"Maximum age or retry count for benign jobs before flagging persistence (e.g., >3 days or retry>20)."}],"live":true,"detection_strategies":["DET0098"],"techniques":["T1197"]}],"live":true,"version":"1.0","techniques":["T1197"]}],"sigma_rules":[{"id":"1ff315dc-2a3a-4b71-8dde-873818d25d39","title":"New BITS Job Created Via Bitsadmin","author":"frack113","status":"test","level":"low","date":"2022-03-01","modified":"2023-03-27","description":"Detects the creation of a new bits job by Bitsadmin","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1197/T1197.md"],"logsource":{"product":"windows","service":"bits-client"},"tags":["attack.persistence","attack.execution","attack.stealth","attack.t1197"],"path":"rules/windows/builtin/bits_client/win_bits_client_new_job_via_bitsadmin.yml","techniques":["T1197"],"cves":[]},{"id":"2ddef153-167b-4e89-86b6-757a9e65dcac","title":"File Download Via Bitsadmin To A Suspicious Target Folder","author":"Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2022-06-28","modified":"2025-12-10","description":"Detects usage of bitsadmin downloading a file to a suspicious target folder","references":["https://blog.netspi.com/15-ways-to-download-a-file/#bitsadmin","https://isc.sans.edu/diary/22264","https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/","https://blog.talosintelligence.com/breaking-the-silence-recent-truebot-activity/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.persistence","attack.execution","attack.stealth","attack.t1197","attack.s0190","attack.t1036.003","attack.command-and-control","attack.t1105"],"path":"rules/windows/process_creation/proc_creation_win_bitsadmin_download_susp_targetfolder.yml","techniques":["T1197","T1036.003","T1105"],"cves":[]},{"id":"5b80a791-ad9b-4b75-bcc1-ad4e1e89c200","title":"File With Suspicious Extension Downloaded Via Bitsadmin","author":"Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2022-06-28","modified":"2023-05-30","description":"Detects usage of bitsadmin downloading a file with a suspicious extension","references":["https://blog.netspi.com/15-ways-to-download-a-file/#bitsadmin","https://isc.sans.edu/diary/22264","https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.persistence","attack.execution","attack.stealth","attack.t1197","attack.s0190","attack.t1036.003","attack.command-and-control","attack.t1105"],"path":"rules/windows/process_creation/proc_creation_win_bitsadmin_download_susp_extensions.yml","techniques":["T1197","T1036.003","T1105"],"cves":[]},{"id":"6d44fb93-e7d2-475c-9d3d-54c9c1e33427","title":"BITS Transfer Job With Uncommon Or Suspicious Remote TLD","author":"Florian Roth (Nextron Systems)","status":"test","level":"medium","date":"2022-06-10","modified":"2025-02-28","description":"Detects a suspicious download using the BITS client from a FQDN that is unusual. Adversaries may abuse BITS jobs to persistently execute or clean up after malicious payloads.","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1197/T1197.md","https://twitter.com/malmoeb/status/1535142803075960832"],"logsource":{"product":"windows","service":"bits-client"},"tags":["attack.persistence","attack.execution","attack.stealth","attack.t1197"],"path":"rules/windows/builtin/bits_client/win_bits_client_new_transfer_via_uncommon_tld.yml","techniques":["T1197"],"cves":[]},{"id":"8518ed3d-f7c9-4601-a26c-f361a4256a0c","title":"Suspicious Download From File-Sharing Website Via Bitsadmin","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2022-06-28","modified":"2026-03-29","description":"Detects usage of bitsadmin downloading a file from a suspicious domain","references":["https://blog.netspi.com/15-ways-to-download-a-file/#bitsadmin","https://isc.sans.edu/diary/22264","https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/","https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/ransomware-hive-conti-avoslocker","https://www.cisa.gov/uscert/ncas/alerts/aa22-321a","https://www.microsoft.com/en-us/security/blog/2024/01/17/new-ttps-observed-in-mint-sandstorm-campaign-targeting-high-profile-individuals-at-universities-and-research-orgs/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.persistence","attack.execution","attack.stealth","attack.t1197","attack.s0190","attack.t1036.003","attack.command-and-control","attack.t1105"],"path":"rules/windows/process_creation/proc_creation_win_bitsadmin_download_file_sharing_domains.yml","techniques":["T1197","T1036.003","T1105"],"cves":[]},{"id":"8ccd35a2-1c7c-468b-b568-ac6cdf80eec3","title":"Bitsadmin to Uncommon IP Server Address","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2022-06-10","modified":"2022-08-24","description":"Detects Bitsadmin connections to IP addresses instead of FQDN names","references":["https://isc.sans.edu/diary/Microsoft+BITS+Used+to+Download+Payloads/21027"],"logsource":{"category":"proxy"},"tags":["attack.command-and-control","attack.execution","attack.stealth","attack.t1071.001","attack.persistence","attack.t1197","attack.s0190"],"path":"rules/web/proxy_generic/proxy_ua_bitsadmin_susp_ip.yml","techniques":["T1071.001","T1197"],"cves":[]},{"id":"90f138c1-f578-4ac3-8c49-eecfd847c8b7","title":"BITS Transfer Job Download From Direct IP","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2023-01-11","modified":"2023-03-27","description":"Detects a BITS transfer job downloading file(s) from a direct IP address.","references":["https://blog.netspi.com/15-ways-to-download-a-file/#bitsadmin","https://isc.sans.edu/diary/22264","https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/","https://blog.talosintelligence.com/breaking-the-silence-recent-truebot-activity/"],"logsource":{"product":"windows","service":"bits-client"},"tags":["attack.persistence","attack.execution","attack.stealth","attack.t1197"],"path":"rules/windows/builtin/bits_client/win_bits_client_new_transfer_via_ip_address.yml","techniques":["T1197"],"cves":[]},{"id":"99c840f2-2012-46fd-9141-c761987550ef","title":"Suspicious Download From Direct IP Via Bitsadmin","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2022-06-28","modified":"2023-02-15","description":"Detects usage of bitsadmin downloading a file using an URL that contains an IP","references":["https://blog.netspi.com/15-ways-to-download-a-file/#bitsadmin","https://isc.sans.edu/diary/22264","https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/","https://blog.talosintelligence.com/breaking-the-silence-recent-truebot-activity/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.persistence","attack.execution","attack.stealth","attack.t1197","attack.s0190","attack.t1036.003"],"path":"rules/windows/process_creation/proc_creation_win_bitsadmin_download_direct_ip.yml","techniques":["T1197","T1036.003"],"cves":[]},{"id":"9eb68894-7476-4cd6-8752-23b51f5883a7","title":"Bitsadmin to Uncommon TLD","author":"Florian Roth (Nextron Systems), Tim Shelton","status":"test","level":"high","date":"2019-03-07","modified":"2023-05-17","description":"Detects Bitsadmin connections to domains with uncommon TLDs","references":["https://twitter.com/jhencinski/status/1102695118455349248","https://isc.sans.edu/forums/diary/Investigating+Microsoft+BITS+Activity/23281/"],"logsource":{"category":"proxy"},"tags":["attack.command-and-control","attack.execution","attack.stealth","attack.t1071.001","attack.persistence","attack.t1197","attack.s0190"],"path":"rules/web/proxy_generic/proxy_ua_bitsadmin_susp_tld.yml","techniques":["T1071.001","T1197"],"cves":[]},{"id":"b85e5894-9b19-4d86-8c87-a2f3b81f0521","title":"BITS Transfer Job Downloading File Potential Suspicious Extension","author":"frack113","status":"test","level":"medium","date":"2022-03-01","modified":"2023-03-27","description":"Detects new BITS transfer job saving local files with potential suspicious extensions","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1197/T1197.md"],"logsource":{"product":"windows","service":"bits-client"},"tags":["attack.persistence","attack.execution","attack.stealth","attack.t1197"],"path":"rules/windows/builtin/bits_client/win_bits_client_new_transfer_saving_susp_extensions.yml","techniques":["T1197"],"cves":[]},{"id":"b9cbbc17-d00d-4e3d-a827-b06d03d2380d","title":"Monitoring For Persistence Via BITS","author":"Sreeman","status":"test","level":"medium","date":"2020-10-29","modified":"2024-01-25","description":"BITS will allow you to schedule a command to execute after a successful download to notify you that the job is finished.\nWhen the job runs on the system the command specified in the BITS job will be executed.\nThis can be abused by actors to create a backdoor within the system and for persistence.\nIt will be chained in a BITS job to schedule the download of malware/additional binaries and execute the program after being downloaded.\n","references":["https://www.fireeye.com/blog/threat-research/2020/10/kegtap-and-singlemalt-with-a-ransomware-chaser.html","http://0xthem.blogspot.com/2014/03/t-emporal-persistence-with-and-schtasks.html","https://isc.sans.edu/diary/Wipe+the+drive+Stealthy+Malware+Persistence+Mechanism+-+Part+1/15394"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.persistence","attack.execution","attack.stealth","attack.t1197"],"path":"rules/windows/process_creation/proc_creation_win_bitsadmin_potential_persistence.yml","techniques":["T1197"],"cves":[]},{"id":"d059842b-6b9d-4ed1-b5c3-5b89143c6ede","title":"File Download Via Bitsadmin","author":"Michael Haag, FPT.EagleEye","status":"test","level":"medium","date":"2017-03-09","modified":"2023-02-15","description":"Detects usage of bitsadmin downloading a file","references":["https://blog.netspi.com/15-ways-to-download-a-file/#bitsadmin","https://isc.sans.edu/diary/22264","https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.persistence","attack.execution","attack.stealth","attack.t1197","attack.s0190","attack.t1036.003","attack.command-and-control","attack.t1105"],"path":"rules/windows/process_creation/proc_creation_win_bitsadmin_download.yml","techniques":["T1197","T1036.003","T1105"],"cves":[]},{"id":"d635249d-86b5-4dad-a8c7-d7272b788586","title":"BITS Transfer Job Download From File Sharing Domains","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2022-06-28","modified":"2026-03-29","description":"Detects BITS transfer job downloading files from a file sharing domain.","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1197/T1197.md","https://twitter.com/malmoeb/status/1535142803075960832","https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/ransomware-hive-conti-avoslocker","https://www.microsoft.com/en-us/security/blog/2024/01/17/new-ttps-observed-in-mint-sandstorm-campaign-targeting-high-profile-individuals-at-universities-and-research-orgs/"],"logsource":{"product":"windows","service":"bits-client"},"tags":["attack.persistence","attack.execution","attack.stealth","attack.t1197"],"path":"rules/windows/builtin/bits_client/win_bits_client_new_transfer_via_file_sharing_domains.yml","techniques":["T1197"],"cves":[]},{"id":"e700ff14-1bff-4d1d-9438-738dff5f0466","title":"BITS Client BitsProxy DLL Loaded By Uncommon Process","author":"UnicornOfHunt","status":"experimental","level":"low","date":"2025-06-04","modified":null,"description":"Detects an uncommon process loading the \"BitsProxy.dll\". This DLL is used when the BITS COM instance or API is used.\nThis detection can be used to hunt for uncommon processes loading this DLL in your environment. Which may indicate potential suspicious activity occurring.\n","references":["https://unicornofhunt.com/2025/05/22/When-Unicorns-Go-Quiet-BITS-Jobs-and-the-Art-of-Stealthy-Transfers/"],"logsource":{"product":"windows","category":"image_load"},"tags":["attack.persistence","attack.execution","attack.stealth","attack.t1197","detection.threat-hunting"],"path":"rules-threat-hunting/windows/image_load/image_load_dll_bitsproxy_load_by_uncommon_process.yml","techniques":["T1197"],"cves":[]},{"id":"f8a56cb7-a363-44ed-a82f-5926bb44cd05","title":"BITS Transfer Job Download To Potential Suspicious Folder","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2022-06-28","modified":"2023-03-27","description":"Detects new BITS transfer job where the LocalName/Saved file is stored in a potentially suspicious location","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1197/T1197.md"],"logsource":{"product":"windows","service":"bits-client"},"tags":["attack.persistence","attack.execution","attack.stealth","attack.t1197"],"path":"rules/windows/builtin/bits_client/win_bits_client_new_trasnfer_susp_local_folder.yml","techniques":["T1197"],"cves":[]},{"id":"fe3a2d49-f255-4d10-935c-bda7391108eb","title":"New BITS Job Created Via PowerShell","author":"frack113","status":"test","level":"low","date":"2022-03-01","modified":"2023-03-27","description":"Detects the creation of a new bits job by PowerShell","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1197/T1197.md"],"logsource":{"product":"windows","service":"bits-client"},"tags":["attack.persistence","attack.execution","attack.stealth","attack.t1197"],"path":"rules/windows/builtin/bits_client/win_bits_client_new_job_via_powershell.yml","techniques":["T1197"],"cves":[]}],"kev_cves":[],"_built":"2026-08-24 19:45 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}