Techniques › T1197
T1197 BITS Jobs
stealth · persistence · execution — Windows · attack.mitre.org · JSON
1
MITRE detection strategy
1
analytics
16
Sigma rules tagged attack.t1197
0
KEV CVEs mapped here
<p>Adversaries may abuse BITS jobs to persistently execute code and perform various background tasks. Windows Background Intelligent Transfer Service (BITS) is a low-bandwidth, asynchronous file transfer mechanism exposed through Component Object Model (COM). BITS is commonly used by updaters, messengers, and other applications preferred to operate in the background (using available idle bandwidth) without interrupting other networked applications. File transfer tasks are implemented as BITS jobs, which contain a queue of one or more file operations.</p><p>The interface to create and manage BITS jobs is accessible through PowerShell and the BITSAdmin tool.</p><p>Adversaries may abuse BITS to download (e.g. Ingress Tool Transfer), execute, and even clean up after running malicious code (e.g. Indicator Removal). BITS tasks are self-contained in the BITS job database, without new files or registry modifications, and often permitted by host firewalls. BITS enabled execution may also enable persistence by creating long-standing jobs (the default maximum lifetime is 90 days and extendable) or invoking an arbitrary program when a job completes or errors (including after system reboots).</p><p>BITS upload functionalities can also be used to perform Exfiltration Over Alternative Protocol.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0098 Detect abuse of Windows BITS Jobs for download, execution and persistence v1.0
AN0274 WindowsBehavioral chain: (1) An actor creates or modifies a BITS job via bitsadmin.exe, PowerShell BITS cmdlets, or COM; (2) the job performs HTTP(S)/SMB network transfers while the owning user is logged on; (3) upon job completion/error, BITS launches a notify command (SetNotifyCmdLine) from svchost.exe -k netsvcs -s BITS, often establishing persistence by keeping long-lived jobs. The strategy correlates process creation, command/script telemetry, BITS-Client operational events, and network connections initiated by BITS.Tunable:
TimeWindowExpectedUpdateHostsSuspiciousCliSwitchesNotifyCmdBlockListUserContextExternalNetCIDRsJobLifetimeThreshold
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1197
Author: frack113
· 2022-03-01 (modified 2023-03-27) · logsource: product=windows service=bits-client · 1ff315dc-2a3a-4b71-8dde-873818d25d39
Detects the creation of a new bits job by Bitsadmin
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
· 2022-06-28 (modified 2025-12-10) · logsource: product=windows category=process_creation · 2ddef153-167b-4e89-86b6-757a9e65dcac
Detects usage of bitsadmin downloading a file to a suspicious target folder
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
· 2022-06-28 (modified 2023-05-30) · logsource: product=windows category=process_creation · 5b80a791-ad9b-4b75-bcc1-ad4e1e89c200
Detects usage of bitsadmin downloading a file with a suspicious extension
Author: Florian Roth (Nextron Systems)
· 2022-06-10 (modified 2025-02-28) · logsource: product=windows service=bits-client · 6d44fb93-e7d2-475c-9d3d-54c9c1e33427
Detects a suspicious download using the BITS client from a FQDN that is unusual. Adversaries may abuse BITS jobs to persistently execute or clean up after malicious payloads.
Author: Florian Roth (Nextron Systems)
· 2022-06-28 (modified 2026-03-29) · logsource: product=windows category=process_creation · 8518ed3d-f7c9-4601-a26c-f361a4256a0c
Detects usage of bitsadmin downloading a file from a suspicious domain
Author: Florian Roth (Nextron Systems)
· 2022-06-10 (modified 2022-08-24) · logsource: category=proxy · 8ccd35a2-1c7c-468b-b568-ac6cdf80eec3
Detects Bitsadmin connections to IP addresses instead of FQDN names
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-01-11 (modified 2023-03-27) · logsource: product=windows service=bits-client · 90f138c1-f578-4ac3-8c49-eecfd847c8b7
Detects a BITS transfer job downloading file(s) from a direct IP address.
Author: Florian Roth (Nextron Systems)
· 2022-06-28 (modified 2023-02-15) · logsource: product=windows category=process_creation · 99c840f2-2012-46fd-9141-c761987550ef
Detects usage of bitsadmin downloading a file using an URL that contains an IP
Author: Florian Roth (Nextron Systems), Tim Shelton
· 2019-03-07 (modified 2023-05-17) · logsource: category=proxy · 9eb68894-7476-4cd6-8752-23b51f5883a7
Detects Bitsadmin connections to domains with uncommon TLDs
Author: frack113
· 2022-03-01 (modified 2023-03-27) · logsource: product=windows service=bits-client · b85e5894-9b19-4d86-8c87-a2f3b81f0521
Detects new BITS transfer job saving local files with potential suspicious extensions
Author: Sreeman
· 2020-10-29 (modified 2024-01-25) · logsource: product=windows category=process_creation · b9cbbc17-d00d-4e3d-a827-b06d03d2380d
BITS will allow you to schedule a command to execute after a successful download to notify you that the job is finished.
When the job runs on the system the command specified in the BITS job will be executed.
This can be abused by actors to create a backdoor within the system and for persistence.
It will be chained in a BITS job to schedule the download of malware/additional binaries and execute the program after being downloaded.
Author: Michael Haag, FPT.EagleEye
· 2017-03-09 (modified 2023-02-15) · logsource: product=windows category=process_creation · d059842b-6b9d-4ed1-b5c3-5b89143c6ede
Detects usage of bitsadmin downloading a file
Author: Florian Roth (Nextron Systems)
· 2022-06-28 (modified 2026-03-29) · logsource: product=windows service=bits-client · d635249d-86b5-4dad-a8c7-d7272b788586
Detects BITS transfer job downloading files from a file sharing domain.
Author: UnicornOfHunt
· 2025-06-04 · logsource: product=windows category=image_load · e700ff14-1bff-4d1d-9438-738dff5f0466
Detects an uncommon process loading the "BitsProxy.dll". This DLL is used when the BITS COM instance or API is used.
This detection can be used to hunt for uncommon processes loading this DLL in your environment. Which may indicate potential suspicious activity occurring.
Author: Florian Roth (Nextron Systems)
· 2022-06-28 (modified 2023-03-27) · logsource: product=windows service=bits-client · f8a56cb7-a363-44ed-a82f-5926bb44cd05
Detects new BITS transfer job where the LocalName/Saved file is stored in a potentially suspicious location
Author: frack113
· 2022-03-01 (modified 2023-03-27) · logsource: product=windows service=bits-client · fe3a2d49-f255-4d10-935c-bda7391108eb
Detects the creation of a new bits job by PowerShell