{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/bitsadmin/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Windows"],"_cs_severities":["medium"],"_cs_tags":["persistence","living-off-the-land","windows","bitsadmin"],"_cs_type":"advisory","_cs_vendors":["Microsoft"],"content_html":"\u003cp\u003eThe Background Intelligent Transfer Service (BITS) is a Windows service designed to facilitate file transfers between machines using idle network bandwidth. Threat actors frequently exploit the \u003ccode\u003ebitsadmin.exe\u003c/code\u003e command-line utility to repurpose this service for malicious objectives. By creating, configuring, and resuming BITS jobs, attackers can achieve persistent execution of arbitrary code, orchestrate the download of second-stage malware, or facilitate the exfiltration of sensitive information. Because BITS activity is a standard component of Windows operations, this technique provides a high degree of stealth, allowing malicious jobs to blend in with legitimate system tasks. Defenders should focus on monitoring for the execution of \u003ccode\u003ebitsadmin.exe\u003c/code\u003e with specific flags associated with job management and persistence.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an adversary to maintain long-term access to compromised endpoints, execute arbitrary commands via scheduled BITS notifications, and perform stealthy data exfiltration. This technique is observed across a wide range of Windows environments and is frequently used in multi-stage attack campaigns targeting both corporate and governmental sectors.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritize the implementation of process-creation logging to monitor for suspicious \u003ccode\u003ebitsadmin.exe\u003c/code\u003e execution.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eDeploy the Sigma rule below to detect suspicious BITS job creation parameters.\u003c/li\u003e\n\u003cli\u003eEnable Sysmon Event ID 1 or Windows Security Event ID 4688 to capture the full command-line arguments, including the process name, parent process, and command-line parameters.\u003c/li\u003e\n\u003cli\u003eTune detections by establishing an allowlist based on legitimate software that utilizes \u003ccode\u003ebitsadmin.exe\u003c/code\u003e in the specific environment.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-12T17:36:13Z","date_published":"2026-10-12T17:36:13Z","id":"https://feed.craftedsignal.io/briefs/2026-10-bits-job-persistence/","summary":"Adversaries leverage the Windows Background Intelligent Transfer Service (BITS) utility bitsadmin.exe to establish persistence, download malicious payloads, or exfiltrate data by creating and scheduling jobs.","title":"BITS Job Persistence via Bitsadmin","url":"https://feed.craftedsignal.io/briefs/2026-10-bits-job-persistence/"}],"language":"en","title":"CraftedSignal Threat Feed - Bitsadmin","version":"https://jsonfeed.org/version/1.1"}