BITSAdmin Download File
Hypothesis and description
The following query identifies Microsoft Background Intelligent Transfer Service utility bitsadmin.exe using the transfer parameter to download a remote object. In addition, look for download or upload on the command-line, the switches are not required to perform a transfer. Capture any files downloaded. Review the reputation of the IP or domain used. Typically once executed, a follow on command will be used to execute the dropped file. Note that the network connection or file modification events related will not spawn or create from bitsadmin.exe, but the artifacts will appear in a parallel process of svchost.exe with a command-line similar to svchost.exe -k netsvcs -s BITS. It's important to review all parallel and child processes to capture any behaviors and artifacts. In some suspicious and malicious instances, BITS jobs will be created. You can use bitsadmin /list /verbose to list out the jobs during investigation.
- Platforms
- Windows
- Domain
- Analytic
- Subtypes
- Process
- Submitted
- 2021-05-11
- Contributors
- Splunk Threat Research <research@splunk.com>
ATT&CK coverage
| Technique | Tactics | Coverage |
|---|---|---|
| T1197 BITS Jobs | Stealth (formerly Defense Evasion), Persistence | Moderate |
| T1105 Ingress Tool Transfer | Command and Control | Moderate |
2 techniques. Links open MITRE ATT&CK.
D3FEND techniques MITRE maps to this analytic
Data model references
Fields from the CAR data model (object/action/field) the analytic reads.
Pseudocode and implementations
Pseudocode implementation of the Splunk search below
processes = search Process:Create
bitsadmin_commands = filter processes where (
exe ="C:\Windows\System32\bitsadmin.exe" AND command_line = *transfer*)
output bitsadmin_commandsTo successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the Endpoint datamodel in the Processes node.
| tstats count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=bitsadmin.exe Processes.process=*transfer* by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_idAcross MITRE's defensive frameworks
Linked through the 2 ATT&CK techniques above.
Counter with D3FEND
Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.
- D3-OTFOutbound Traffic Filtering2 shared
- D3-RPARelay Pattern Analysis2 shared
- D3-APCAApplication Protocol Command Analysis2 shared
- D3-CSPPClient-server Payload Profiling2 shared
- D3-NTCDNetwork Traffic Community Deviation2 shared
- D3-NTFNetwork Traffic Filtering2 shared
- D3-NTSANetwork Traffic Signature Analysis2 shared
- D3-PHDURAPer Host Download-Upload Ratio Analysis2 shared
- D3-PMADProtocol Metadata Anomaly Detection2 shared
- D3-RTSDRemote Terminal Session Detection2 shared
- D3-UGLPAUser Geolocation Logon Pattern Analysis2 shared
- D3-IPCTAIPC Traffic Analysis1 shared