bits_client | Detection.FYI

BITS Transfer Job Download From Direct IP

Apr 28, 2026 · attack.persistence attack.execution attack.stealth attack.t1197 ·
Share on:

Detects a BITS transfer job downloading file(s) from a direct IP address.

Read More
BITS Transfer Job Download From File Sharing Domains

Apr 28, 2026 · attack.persistence attack.execution attack.stealth attack.t1197 ·
Share on:

Detects BITS transfer job downloading files from a file sharing domain.

Read More
BITS Transfer Job Download To Potential Suspicious Folder

Apr 28, 2026 · attack.persistence attack.execution attack.stealth attack.t1197 ·
Share on:

Detects new BITS transfer job where the LocalName/Saved file is stored in a potentially suspicious location

Read More
BITS Transfer Job Downloading File Potential Suspicious Extension

Apr 28, 2026 · attack.persistence attack.execution attack.stealth attack.t1197 ·
Share on:

Detects new BITS transfer job saving local files with potential suspicious extensions

Read More
BITS Transfer Job With Uncommon Or Suspicious Remote TLD

Apr 28, 2026 · attack.persistence attack.execution attack.stealth attack.t1197 ·
Share on:

Detects a suspicious download using the BITS client from a FQDN that is unusual. Adversaries may abuse BITS jobs to persistently execute or clean up after malicious payloads.

Read More
New BITS Job Created Via Bitsadmin

Apr 28, 2026 · attack.persistence attack.execution attack.stealth attack.t1197 ·
Share on:

Detects the creation of a new bits job by Bitsadmin

Read More
New BITS Job Created Via PowerShell

Apr 28, 2026 · attack.persistence attack.execution attack.stealth attack.t1197 ·
Share on:

Detects the creation of a new bits job by PowerShell

Read More