Used for managing background intelligent transfer Located at: C:\Windows\System32\bitsadmin.exe; C:\Windows\SysWOW64\bitsadmin.exe.
bitsadminbitsadminSandbox: execFile · Timeout: 30s
system.file.alternate-data-stream network.transfer.download system.file.copy security.execution.command Outputs
process.output Command execution output
filesystem_writeprocess_spawnnetwork_traffic Produces
process.output| Resource | Value |
|---|---|
| CPU | low |
| Memory | 16 MB |
| Network | medium |
| Disk I/O | low |
Create a bitsadmin job named 1, add cmd.exe to the job, configure the job to run the target command from an Alternate data stream, then resume and complete the job. (Performs execution of specified file in the alternate data stream, can be used as a defensive evasion or persistence technique.)
bitsadmin /create 1 bitsadmin /addfile 1 c:\windows\system32\cmd.exe c:\data\playfolder\cmd.exe bitsadmin /SetNotifyCmdLine 1 c:\data\playfolder\1.txt:cmd.exe NULL bitsadmin /RESUME 1 bitsadmin /complete 1Create a bitsadmin job named 1, add cmd.exe to the job, configure the job to run the target command, then resume and complete the job. (Download file from Internet)
bitsadmin /create 1 bitsadmin /addfile 1 https://live.sysinternals.com/autoruns.exe c:\data\playfolder\autoruns.exe bitsadmin /RESUME 1 bitsadmin /complete 1Command for copying cmd.exe to another folder (Copy file)
bitsadmin /create 1 & bitsadmin /addfile 1 c:\windows\system32\cmd.exe c:\data\playfolder\cmd.exe & bitsadmin /RESUME 1 & bitsadmin /Complete 1 & bitsadmin /resetOne-liner that creates a bitsadmin job named 1, add cmd.exe to the job, configure the job to run the target command, then resume and complete the job. (Execute binary file specified. Can be used as a defensive evasion.)
bitsadmin /create 1 & bitsadmin /addfile 1 c:\windows\system32\cmd.exe c:\data\playfolder\cmd.exe & bitsadmin /SetNotifyCmdLine 1 c:\data\playfolder\cmd.exe NULL & bitsadmin /RESUME 1 & bitsadmin /Reset| Type | Rule / Indicator |
|---|---|
| sigma | https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_bitsadmin_download.yml |
| sigma | https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/web/proxy_generic/proxy_ua_bitsadmin_susp_tld.yml |
| sigma | https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_bitsadmin_potential_persistence.yml |
| splunk | https://github.com/splunk/security_content/blob/3f77e24974239fcb7a339080a1a483e6bad84a82/detections/endpoint/bitsadmin_download_file.yml |
| ioc | Child process from bitsadmin.exe |
| ioc | bitsadmin creates new files |
| ioc | bitsadmin adds data to alternate data stream |
bitsadmin is a Windows LOLBin. Used for managing background intelligent transfer Located at: C:\Windows\System32\bitsadmin.exe; C:\Windows\SysWOW64\bitsadmin.exe.