Abuse of PowerShell Start-BitsTransfer for Data Exfiltration

The PowerShell cmdlet Start-BitsTransfer is a legitimate administrative tool used for managing file transfers via the Background Intelligent Transfer Service (BITS). However, its capability to move files asynchronously and persistently makes it a prime target for abuse by threat actors. By leveraging BITS, attackers can perform background data exfiltration or download secondary malicious payloads that bypass traditional network inspection or session-based security controls. This technique is frequently observed in malware campaigns, including those associated with Gozi, where BITS jobs are utilized to maintain persistent connectivity or stealthy data movement. Defenders must distinguish between administrative BITS operations and unauthorized process executions, as the service's legitimate use in Windows updates and system management creates a significant source of noise.

Impact

Successful abuse of Start-BitsTransfer can lead to unauthorized exfiltration of sensitive information, potentially compromising intellectual property or personally identifiable information (PII). Furthermore, it provides attackers with a reliable mechanism for persistence and secondary stage delivery, complicating incident response efforts by obfuscating traffic through legitimate Windows system processes.

Recommendation

• Deploy the Sigma rule below to monitor for Start-BitsTransfer execution in your environment, focusing on parent-child process relationships to differentiate between administrative and suspicious activity.
• Ingest full command-line arguments for all PowerShell executions into your SIEM to allow for parsing of file paths used in BITS jobs.
• Baseline legitimate administrative use of BITS in your environment to reduce false positives during incident response.