CmdID

CmdID / PowerShell / Cmdlets / Start

Start-BitsTransfer

Creates a BITS transfer job. Windows Server PowerShell reference

From the Windows Server PowerShell reference 33 parameters 3 Sigma rules look for it Its page in the reference

Opens CmdID with your command, read as PowerShell. It is read in your browser and sent nowhere.

Parameters

33 in the Windows Server PowerShell reference
Show its 33 parameters
-ACLFlagsSpecifies the owner and access control list (ACL) information to maintain for the transfer job.
-AsynchronousIndicates that the cmdlet creates and processes BITS transfer job in the background.
-AuthenticationSpecifies the authentication mechanism to be used at the server.
-CertHashSpecifies a SHA1 hash that identifies the certificate.
-CertStoreLocationSpecifies the certificate store location to use for to look up the certificate.
-CertStoreNameSpecifies the name of the certificate store.
-Confirm, -cfPrompts you for confirmation before running the cmdlet.
-CredentialSpecifies the credentials to use to authenticate the user to the server that is specified in the value of the *Source* parameter.
-CustomHeadersSpecifies one or more custom HTTP headers to include in the request to the server.
-CustomHeadersWriteOnlyIndicates that the HTTP custom headers for this job are write-only.
-DescriptionDescribes the BITS transfer job.
-DestinationSpecifies an array that contains the destination location and the names of the files that you want to transfer.
-DisplayNameSpecifies a display name for the BITS transfer job.
-DynamicIndicates that the transfer uses the dynamic setting.
-HttpMethodSpecifies a method for the transfer other than the default method GET.
-MaxDownloadTimeSpecifies the maximum time, in seconds, for transferring the files in a job.
-NotifyCmdLineSpecifies a program to run after the job finishes or encounters an error.
-NotifyFlagsSpecifies the type of event notification you want to receive, such as job transferred events.
-PrioritySets the priority of the BITS transfer job, which affects bandwidth usage.
-ProxyAuthenticationSpecifies the authentication mechanism to use at the Web proxy.
-ProxyBypassSpecifies a list of host names to use for a direct connection.
-ProxyCredentialSpecifies the credentials to use to authenticate the user at the proxy.
-ProxyListSpecifies a list of proxies to use.
-ProxyUsageSpecifies the proxy usage settings.
-RetryIntervalSpecifies the minimum length of time, in seconds, that BITS waits before an attempt to transfer the file after BITS encounters a transient error.
-RetryTimeoutSpecifies the length of time, in seconds, that BITS attempts to transfer the file after the first transient error occurs.
-SecurityFlagsSpecifies security flags for the HTTP request.
-SourceSpecifies the source location and the names of the files that you want to transfer.
-SuspendedIndicates that the cmdlet suspends the BITS transfer job.
-TransferPolicySpecifies the network cost states in which the transfer is allowed to be scheduled.
-TransferTypeSpecifies the BITS transfer job type.
-UseStoredCredentialSpecifies that credentials stored in the Windows Credential Manager should be used for authentication when required for the specified target server type.
-WhatIf, -wiShows what would happen if the cmdlet runs.

What looks for it

Sigma process creation rules that name Start-BitsTransfer
highSuspicious Child Process of SolarWinds WebHelpDeskHuntress Team, Swachchhanda Shrawan Poudel (Nextron Systems)
highSuspicious Download from Office DomainFlorian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
mediumUsage Of Web Request Commands And CmdletsJames Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger