T1197 — BITS Jobs
Tactics: Stealth, Persistence, Execution · Platforms: Windows
Adversaries may abuse BITS jobs to persistently execute code and perform various background tasks. Windows Background Intelligent Transfer Service (BITS) is a low-bandwidth, asynchronous file transfer mechanism exposed through Component Object Model (COM). BITS is commonly used by updaters,…
Sigma detection rules (1)
T1197 BITS Jobs
title: T1197 BITS Jobs
id: f69293ea-d3a1-48f1-996c-39bad39ea735
description: 'Detect abuse of Windows BITS Jobs for download, execution and persistence. (Retargeted to Sysmon EventID matching process_creation telemetry for reliable field coverage.) Tune using: TimeWindow, ExpectedUpdateHosts, SuspiciousCliSwitches, NotifyCmdBlockList, UserContext, ExternalNetCIDRs.'
references:
- https://attack.mitre.org/techniques/T1197
author: Shahrukh Khan
date: 2026-04-23
license: MIT
tags:
- attack.stealth
- attack.persistence
- attack.execution
- attack.t1197
logsource:
category: process_creation
product: windows
service: sysmon
detection:
selection:
Image|endswith: '\bitsadmin.exe'
CommandLine|contains: '/transfer'
condition: selection
falsepositives:
- Legitimate use of bitsadmin for software deployment by IT — rare in modern environments since bitsadmin is deprecated, which is itself a mild positive signal.
level: medium
Explore