BITS Jobs

T1197

About this technique

Adversaries may abuse BITS jobs to persistently execute code and perform various background tasks. Windows Background Intelligent Transfer Service (BITS) is a low-bandwidth, asynchronous file transfer mechanism exposed through Component Object Model (COM). BITS is commonly used by updaters, messengers, and other applications preferred to operate in the background (using available idle bandwidth) without interrupting other networked applications. File transfer tasks are implemented as BITS jobs, which contain a queue of one or more file operations.

The interface to create and manage BITS jobs is accessible through PowerShell and the BITSAdmin tool.

Adversaries may abuse BITS to download (e.g. Ingress Tool Transfer), execute, and even clean up after running malicious code (e.g. Indicator Removal). BITS tasks are self-contained in the BITS job database, without new files or registry modifications, and often permitted by host firewalls. BITS enabled execution may also enable persistence by creating long-standing jobs (the default maximum lifetime is 90 days and extendable) or invoking an arbitrary program when a job completes or errors (including after system reboots).

BITS upload functionalities can also be used to perform Exfiltration Over Alternative Protocol.

Detection rules21

Rules on DetectionCode tagged with T1197.

Sigma16

Rule	Level	Log source
BITS Transfer Job Download From Direct IP	high	windows / NULL
BITS Transfer Job Download From File Sharing Domains	high	windows / NULL
BITS Transfer Job Download To Potential Suspicious Folder	high	windows / NULL
Bitsadmin to Uncommon IP Server Address	high	NULL / proxy
Bitsadmin to Uncommon TLD	high	NULL / proxy
File Download Via Bitsadmin To A Suspicious Target Folder	high	windows / process_creation
File With Suspicious Extension Downloaded Via Bitsadmin	high	windows / process_creation
Suspicious Download From Direct IP Via Bitsadmin	high	windows / process_creation
Suspicious Download From File-Sharing Website Via Bitsadmin	high	windows / process_creation
BITS Transfer Job Downloading File Potential Suspicious Extension	medium	windows / NULL
BITS Transfer Job With Uncommon Or Suspicious Remote TLD	medium	windows / NULL
File Download Via Bitsadmin	medium	windows / process_creation
File Download Via Bitsadmin To An Uncommon Target Folder	medium	windows / process_creation
Monitoring For Persistence Via BITS	medium	windows / process_creation
New BITS Job Created Via Bitsadmin	low	windows / NULL
New BITS Job Created Via PowerShell	low	windows / NULL

Splunk5

Rule	Type	Risk	Data source
BITS Job Persistence	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
BITSAdmin Download File	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Cisco NVM - Curl Execution With Insecure Flags	Anomaly	NULL	Cisco Network Visibility Module Flow Data
Cisco NVM - Suspicious Download From File Sharing Website	Anomaly	NULL	Cisco Network Visibility Module Flow Data
PowerShell Start-BitsTransfer	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2

Groups5

Software8

Bazar BITSAdmin Cobalt Strike Egregor JPIN MarkiRAT ProLock UBoatRAT

Campaigns0

None recorded.

Procedure examples13

Groups5

Used by	Procedure example
GroupAPT39	APT39 has used the BITS protocol to exfiltrate stolen data from a compromised host. FBI FLASH APT39 September 2020
GroupAPT41	APT41 used BITSAdmin to download and install payloads. Crowdstrike GTR2020 Mar 2020 FireEye APT41 March 2020
GroupLeviathan	Leviathan has used BITSAdmin to download additional tools. FireEye Periscope March 2018
GroupPatchwork	Patchwork has used BITS jobs to download malicious payloads. Unit 42 BackConfig May 2020
GroupWizard Spider	Wizard Spider has used batch scripts that utilizes WMIC to execute a BITSAdmin transfer of a ransomware payload to each compromised machine. Mandiant FIN12 Oct 2021

Software8

Used by	Procedure example
MalwareBazar	Bazar has been downloaded via Windows BITS functionality. NCC Group Team9 June 2020
ToolBITSAdmin	BITSAdmin can be used to create BITS Jobs to launch a malicious process. TrendMicro Tropic Trooper Mar 2018
MalwareCobalt Strike	Cobalt Strike can download a hosted "beacon" payload using BITSAdmin. Cobalt Strike Manual 4.3 November 2020 CobaltStrike Scripted Web Delivery Talos Cobalt Strike September 2020
MalwareEgregor	Egregor has used BITSadmin to download and execute malicious DLLs. Intrinsec Egregor Nov 2020
MalwareJPIN	A JPIN variant downloads the backdoor payload via the BITS service. Microsoft PLATINUM April 2016
MalwareMarkiRAT	MarkiRAT can use BITS Utility to connect with the C2 server. Kaspersky Ferocious Kitten Jun 2021
MalwareProLock	ProLock can use BITS jobs to download its malicious payload. Group IB Ransomware September 2020
MalwareUBoatRAT	UBoatRAT takes advantage of the /SetNotifyCmdLine option in BITSAdmin to ensure it stays running on a system to maintain persistence. PaloAlto UBoatRAT Nov 2017

References7

CTU BITS Malware June 2016 Open source
Counter Threat Unit Research Team. (2016, June 6). Malware Lingers with BITS. Retrieved January 12, 2018.
Microsoft BITS Open source
Microsoft. (n.d.). Background Intelligent Transfer Service. Retrieved January 12, 2018.
Microsoft BITSAdmin Open source
Microsoft. (n.d.). BITSAdmin Tool. Retrieved January 12, 2018.
Microsoft COM Open source
Microsoft. (n.d.). Component Object Model (COM). Retrieved November 22, 2017.
Mondok Windows PiggyBack BITS May 2007 Open source
Mondok, M. (2007, May 11). Malware piggybacks on Windows’ Background Intelligent Transfer Service. Retrieved January 12, 2018.
PaloAlto UBoatRAT Nov 2017 Open source
Hayashi, K. (2017, November 28). UBoatRAT Navigates East Asia. Retrieved January 12, 2018.
Symantec BITS May 2007 Open source
Florio, E. (2007, May 9). Malware Update with Windows Update. Retrieved January 12, 2018.

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.