T1197
BITS Jobs
Windowsnothing on this site yetT1197 on attack.mitre.org
Adversaries may abuse BITS jobs to persistently execute code and perform various background tasks. Windows Background Intelligent Transfer Service (BITS) is a low-bandwidth, asynchronous file transfer mechanism exposed through Component Object Model (COM). BITS is commonly used by updaters, messengers, and other applications preferred to operate in the background (using available idle bandwidth) without interrupting other networked applications.
If this is happening now
Checklists and playbooks to open while the alert is still live.
Playbook for this stage
Suspicious execution on an endpoint
An EDR alert, an unexplained process, or a user reporting something odd.
how MITRE says to see it
Detect abuse of Windows BITS Jobs for download, execution and persistence
- Behavioral chain: (1) An actor creates or modifies a BITS job via bitsadmin.exe, PowerShell BITS cmdlets, or COM; (2) the job performs HTTP(S)/SMB network transfers while the owning user is logged on; (3) upon job completion/error, BITS launches a notify command (SetNotifyCmdLine) from svchost.exe -k netsvcs -s BITS,...
what reduces it
- M1037 Filter Network Traffic. Modify network and/or host firewall rules, as well as other network controls, to only allow legitimate BITS traffic.
- M1028 Operating System Configuration. Consider reducing the default BITS job lifetime in Group Policy or by editing the `JobInactivityTimeout` and `MaxDownloadTime` Registry values in ` HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\BITS`.
- M1018 User Account Management. Consider limiting access to the BITS interface to specific users or groups.