T1197 BITS Jobs

Adversaries may abuse BITS jobs to persistently execute code and perform various background tasks. MITRE ATT&CK

1 program on CmdID 6 Sigma rules T1197 on attack.mitre.org

Programs for it

documented by LOLBAS and GTFOBins, or named by its rules

bitsadmin.exeits Sigma rules

Sigma rules tagged with it

process creation, the highest levels first

highFile Download Via Bitsadmin To A Suspicious Target FolderFlorian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) · Windows

highFile With Suspicious Extension Downloaded Via BitsadminFlorian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) · Windows

highSuspicious Download From Direct IP Via BitsadminFlorian Roth (Nextron Systems) · Windows

highSuspicious Download From File-Sharing Website Via BitsadminFlorian Roth (Nextron Systems) · Windows

mediumFile Download Via BitsadminMichael Haag, FPT.EagleEye · Windows

mediumMonitoring For Persistence Via BITSSreeman · Windows

Command lines CmdID reads as it

everyday examples from tldr-pages, CC BY 4.0

To add a file to the job on the page for bitsadmin addfile

bitsadmin /addfile myDownloadJob http://downloadsrv/10mb.zip c:\10mb.zipIdentify

To transfer 100 bytes from offset 0, 100 bytes from offset 2000, and the remaining bytes from offset 5000 to the end of the file on the page for bitsadmin addfilewithranges

bitsadmin /addfilewithranges http://downloadsrv/10mb.zip c:\10mb.zip 0:100,2000:100,5000:eofIdentify

To start a transfer job named myDownloadJob on the page for bitsadmin transfer

bitsadmin /transfer myDownloadJob http://prodserver/audio.wma c:\downloads\audio.wmaIdentify

An example is here when CmdID’s reading of it names T1197: a Sigma rule it trips is tagged with it, or its abuse is documented as it.