T1197ExecutionPersistenceStealth
BITS Jobs
Adversaries may abuse BITS jobs to persistently execute code and perform various background tasks. Windows Background Intelligent Transfer Service (BITS) is a low-bandwidth, asynchronous file transfer mechanism exposed through Component Object Model (COM). BITS is commonly used by updaters, messengers, and other applications preferred to operate in the background (using available idle bandwidth)…
CVEs0
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.0
Reports0
Detections
16 Sigma rules tagged T1197BITS JobsT119716 general rules
- BITS Transfer Job Download From Direct IPhightest
- BITS Transfer Job Download From File Sharing Domainshightest
- BITS Transfer Job Download To Potential Suspicious Folderhightest
- Bitsadmin to Uncommon IP Server Addresshightest
- Bitsadmin to Uncommon TLDhightest
- File Download Via Bitsadmin To A Suspicious Target Folderhightest
- File With Suspicious Extension Downloaded Via Bitsadminhightest
- Suspicious Download From Direct IP Via Bitsadminhightest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to BITS Jobs
0 CVEs, by priority. Each link shows its badge.No CVEs are linked to this technique yet.