T1197 — BITS Jobs

Tactics: Stealth, Persistence, Execution · Platforms: Windows

Adversaries may abuse BITS jobs to persistently execute code and perform various background tasks. Windows Background Intelligent Transfer Service (BITS) is a low-bandwidth, asynchronous file transfer mechanism exposed through Component Object Model (COM). BITS is commonly used by updaters,…

Sigma detection rules (1)

T1197 BITS Jobs

title: T1197 BITS Jobs
id: f69293ea-d3a1-48f1-996c-39bad39ea735
description: 'Detect abuse of Windows BITS Jobs for download, execution and persistence. (Retargeted to Sysmon EventID matching process_creation telemetry for reliable field coverage.) Tune using: TimeWindow, ExpectedUpdateHosts, SuspiciousCliSwitches, NotifyCmdBlockList, UserContext, ExternalNetCIDRs.'
references:
  - https://attack.mitre.org/techniques/T1197
author: Shahrukh Khan
date: 2026-04-23
license: MIT
tags:
  - attack.stealth
  - attack.persistence
  - attack.execution
  - attack.t1197

logsource:
  category: process_creation
  product: windows
  service: sysmon

detection:
  selection:
    Image|endswith: '\bitsadmin.exe'
    CommandLine|contains: '/transfer'

  condition: selection

falsepositives:
  - Legitimate use of bitsadmin for software deployment by IT — rare in modern environments since bitsadmin is deprecated, which is itself a mild positive signal.

level: medium

Explore