attack.t1197

Detects a suspicious download using the BITS client from a FQDN that is unusual. Adversaries may abuse BITS jobs to persistently execute or clean up after malicious payloads.

Bitsadmin to Uncommon IP Server Address

Apr 28, 2026 · attack.command-and-control attack.execution attack.stealth attack.t1071.001 attack.persistence attack.t1197 attack.s0190 ·

Share on:

Detects Bitsadmin connections to IP addresses instead of FQDN names

Bitsadmin to Uncommon TLD

Apr 28, 2026 · attack.command-and-control attack.execution attack.stealth attack.t1071.001 attack.persistence attack.t1197 attack.s0190 ·

Share on:

Detects Bitsadmin connections to domains with uncommon TLDs

File Download Via Bitsadmin

Apr 28, 2026 · attack.persistence attack.execution attack.stealth attack.t1197 attack.s0190 attack.t1036.003 attack.command-and-control attack.t1105 ·

Share on:

Detects usage of bitsadmin downloading a file

File Download Via Bitsadmin To A Suspicious Target Folder

Apr 28, 2026 · attack.persistence attack.execution attack.stealth attack.t1197 attack.s0190 attack.t1036.003 attack.command-and-control attack.t1105 ·

Share on:

Detects usage of bitsadmin downloading a file to a suspicious target folder

File With Suspicious Extension Downloaded Via Bitsadmin

Apr 28, 2026 · attack.persistence attack.execution attack.stealth attack.t1197 attack.s0190 attack.t1036.003 attack.command-and-control attack.t1105 ·

Share on:

Detects usage of bitsadmin downloading a file with a suspicious extension

Monitoring For Persistence Via BITS

Apr 28, 2026 · attack.persistence attack.execution attack.stealth attack.t1197 ·

Share on:

BITS will allow you to schedule a command to execute after a successful download to notify you that the job is finished. When the job runs on the system the command specified in the BITS job will be executed. This can be abused by actors to create a backdoor within the system and for persistence. It will be chained in a BITS job to schedule the download of malware/additional binaries and execute the program after being downloaded.

New BITS Job Created Via Bitsadmin

Apr 28, 2026 · attack.persistence attack.execution attack.stealth attack.t1197 ·

Share on:

Detects the creation of a new bits job by Bitsadmin

New BITS Job Created Via PowerShell

Apr 28, 2026 · attack.persistence attack.execution attack.stealth attack.t1197 ·

Share on:

Detects the creation of a new bits job by PowerShell

Suspicious Download From Direct IP Via Bitsadmin

Apr 28, 2026 · attack.persistence attack.execution attack.stealth attack.t1197 attack.s0190 attack.t1036.003 ·

Share on:

Detects usage of bitsadmin downloading a file using an URL that contains an IP