T1197 BITS Jobs
Adversaries may abuse BITS jobs to persistently execute code and perform various background tasks. Windows Background Intelligent Transfer Service (BITS) is a low-bandwidth, asynchronous file transfer mechanism exposed through [Component Object Model](https://attack.mitre.org/techniques/T1559/001) (COM).(Citation: Microsoft COM)(Citation: Microsoft BITS) BITS is commonly used by updaters,…
Who uses it · with stories on Jábega
Sigma rules to hunt it
- BITS Transfer Job Download From Direct IPhightest · windows
- BITS Transfer Job Download From File Sharing Domainshightest · windows
- BITS Transfer Job Download To Potential Suspicious Folderhightest · windows
- Bitsadmin to Uncommon IP Server Addresshightest · proxy
- Bitsadmin to Uncommon TLDhightest · proxy
- File Download Via Bitsadmin To A Suspicious Target Folderhightest · windows
- File With Suspicious Extension Downloaded Via Bitsadminhightest · windows
- Suspicious Download From Direct IP Via Bitsadminhightest · windows
- Suspicious Download From File-Sharing Website Via Bitsadminhightest · windows
- BITS Transfer Job Downloading File Potential Suspicious Extensionmediumtest · windows
- BITS Transfer Job With Uncommon Or Suspicious Remote TLDmediumtest · windows
- File Download Via Bitsadminmediumtest · windows
- Monitoring For Persistence Via BITSmediumtest · windows
Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.