T1197 Google Chronicle · YARA-L

Detect BITS Jobs in Google Chronicle

Adversaries may abuse Windows Background Intelligent Transfer Service (BITS) jobs to persistently execute code and perform background tasks such as downloading malicious payloads, executing arbitrary programs on job completion or error, and cleaning up artifacts. BITS is a COM-based file transfer mechanism built into Windows, commonly used by Windows Update and software installers. Adversaries exploit it via bitsadmin.exe or PowerShell BITS cmdlets to download tools from external infrastructure, achieve persistence using /SetNotifyCmdLine to invoke arbitrary executables when a job completes or errors (including after reboots), and exfiltrate data. BITS jobs are stored in a binary database (%ALLUSERSPROFILE%\Microsoft\Network\Downloader\) rather than in registry or filesystem, making them resistant to many persistence-focused detections. Active threat groups including APT39, APT41, Leviathan, Patchwork, and Wizard Spider have leveraged BITS for payload delivery and persistence.

MITRE ATT&CK

Tactic
Defense Evasion Persistence
Technique
T1197 BITS Jobs
Canonical reference
https://attack.mitre.org/techniques/T1197/

YARA-L Detection Query

Google Chronicle (YARA-L)
yaral 
rule bits_jobs_abuse_t1197 {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects BITS job abuse via bitsadmin.exe or PowerShell BITS cmdlets for payload download, persistence via notification commands, or staging to suspicious directories. Maps to MITRE ATT&CK T1197."
    mitre_attack_tactic = "Persistence, Defense Evasion"
    mitre_attack_technique = "T1197"
    severity = "HIGH"
    confidence = "HIGH"
    version = "1.0"
    created = "2026-04-18"

  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    $e.target.process.file.full_path != ""

    (
      // Branch 1: bitsadmin.exe with suspicious arguments
      (
        re.regex($e.target.process.file.full_path, `(?i)bitsadmin\.exe$`) and
        (
          re.regex($e.target.process.command_line, `(?i)(/SetNotifyCmdLine|/SetNotifyFlags|/transfer|/addfile|/reset)`) or
          re.regex($e.target.process.command_line, `(?i)(\\AppData\\|\\Users\\Public\\|\\ProgramData\\|\\Windows\\Temp\\|C:\\Temp\\)`) or
          re.regex($e.target.process.command_line, `(?i)\.(exe|dll|ps1|bat|cmd|vbs|js|hta)(\s|$)`) or
          (
            re.regex($e.target.process.command_line, `https?://`) and
            not re.regex($e.target.process.command_line, `(?i)(microsoft\.com|windowsupdate\.com|windows\.com)`)
          )
        )
      ) or
      // Branch 2: PowerShell BITS cmdlets with suspicious indicators
      (
        re.regex($e.target.process.file.full_path, `(?i)(powershell|pwsh)\.exe$`) and
        re.regex($e.target.process.command_line, `(?i)(Start-BitsTransfer|New-BitsTransfer|Add-BitsFile|Get-BitsTransfer|Set-BitsTransfer)`) and
        (
          re.regex($e.target.process.command_line, `(?i)(\\AppData\\|\\Users\\Public\\|\\ProgramData\\|\\Windows\\Temp\\)`) or
          (
            re.regex($e.target.process.command_line, `https?://`) and
            not re.regex($e.target.process.command_line, `(?i)(microsoft\.com|windowsupdate\.com|windows\.com)`)
          ) or
          re.regex($e.target.process.command_line, `(?i)\.(exe|dll|ps1|bat|cmd|vbs|hta)(\s|$)`)
        )
      )
    )

  condition:
    $e
}
high severity high confidence

Chronicle YARA-L 2.0 rule detecting BITS job abuse via bitsadmin.exe or PowerShell BITS cmdlets. Branch 1 targets bitsadmin.exe with notification callbacks, suspicious download destinations or file extensions, or downloads from non-Microsoft URLs. Branch 2 targets PowerShell BITS cmdlets (Start-BitsTransfer, New-BitsTransfer, Add-BitsFile) with suspicious destination paths or external URLs.

Data Sources

Google Chronicle SIEMWindows Endpoint Telemetry via Chronicle ForwarderSysmon UDM Ingestion

Required Tables

UDM events with metadata.event_type = PROCESS_LAUNCH

False Positives & Tuning

  • Legitimate Windows Update or Defender signature updates using bitsadmin.exe targeting microsoft.com — the domain regex exclusion handles most cases but monitor for edge cases with URL redirection through intermediate CDN domains
  • Enterprise patch management systems (WSUS, Intune) invoking BITS for package distribution to ProgramData — validate parent process is a known management agent (MicrosoftEdgeUpdate.exe, MsMpEng.exe, etc.)
  • Developer or DevOps scripts using Start-BitsTransfer to download build artifacts or dependencies to local temp directories — correlate principal.user.userid with known developer accounts
Download portable Sigma rule (.yml)

Other platforms for T1197

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1BITSAdmin Download from External URL

    Expected signal: Sysmon Event ID 1: Process Create with Image=bitsadmin.exe, CommandLine containing '/transfer' and 'http://127.0.0.1:8080/test.exe' and '%TEMP%\df00tech-test.exe'. Microsoft-Windows-Bits-Client EventID 3 (job created with name 'df00tech-test'). EventID 60 (job error, since no HTTP server is listening at 127.0.0.1:8080 — but job creation telemetry still fires). Security Event ID 4688 (if command line auditing enabled).

  2. Test 2BITS Persistence via SetNotifyCmdLine

    Expected signal: Sysmon Event ID 1: Four separate bitsadmin.exe Process Create events — for /create, /addfile, /SetNotifyCmdLine (CommandLine contains 'cmd.exe /c calc.exe'), and /SetNotifyFlags. Microsoft-Windows-Bits-Client EventID 3 (job creation). If the job errors (no HTTP server), the notify command fires: Sysmon EventID 1 for cmd.exe spawned by svchost.exe (BITS service) with ParentCommandLine containing BITS service context.

  3. Test 3PowerShell Start-BitsTransfer to Suspicious Location

    Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing 'Start-BitsTransfer' and '$env:APPDATA' and 'payload.exe'. Microsoft-Windows-Bits-Client EventID 3 (job created programmatically). PowerShell ScriptBlock Log EventID 4104 with full Start-BitsTransfer cmdlet parameters. Sysmon EventID 3: Network connection attempt from svchost.exe (BITS service) to 127.0.0.1:8080.

  4. Test 4BITSAdmin Upload for Exfiltration Simulation

    Expected signal: Sysmon Event ID 1: bitsadmin.exe Process Create with '/upload' in CommandLine. Microsoft-Windows-Bits-Client EventID 3 (job created with upload type). Sysmon EventID 3: Outbound network connection from svchost.exe to 127.0.0.1:8080. EventID 60 (job error, connection refused) with upload direction noted in event data.

Last updated: 2026-04-18 Research depth: deep
References (10)

Unlock Pro Content

Get the full detection package for T1197 including response playbook, investigation guide, and atomic red team tests.

Response PlaybookInvestigation GuideHunting QueriesAtomic Red Team TestsTuning Guidance
Sign Up for Pro View Pricing

Related Detections

Related Techniques

T1105Ingress Tool TransferT1053.005Scheduled TaskT1059.001PowerShellT1070Indicator RemovalT1048Exfiltration Over Alternative ProtocolT1218.003CMSTPT1543.003Windows ServiceT1547.001Registry Run Keys / Startup FolderT1036Masquerading

Same Tactic: Defense Evasion

Popular Detections