Techniques › T1197 › AN0274
AN0274 Analytic 0274
Windows · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Behavioral chain: (1) An actor creates or modifies a BITS job via bitsadmin.exe, PowerShell BITS cmdlets, or COM; (2) the job performs HTTP(S)/SMB network transfers while the owning user is logged on; (3) upon job completion/error, BITS launches a notify command (SetNotifyCmdLine) from svchost.exe -k netsvcs -s BITS, often establishing persistence by keeping long-lived jobs. The strategy correlates process creation, command/script telemetry, BITS-Client operational events, and network connections initiated by BITS.</p>
- Detects
- T1197 BITS Jobs
- Part of
- DET0098 Detect abuse of Windows BITS Jobs for download, execution and persistence
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| WinEventLog:Security | EventCode=4688 | DC0032 Process Creation |
| WinEventLog:Sysmon | EventCode=3, 22 | DC0082 Network Connection Creation |
| WinEventLog:PowerShell | EventCode=4103, 4104, 4105, 4106 | DC0064 Command Execution |
| WinEventLog:System | EventCode=7036 | DC0060 Service Creation |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
TimeWindow | Correlation window linking job creation, transfer, and notify execution (e.g., 30m–24h depending on environment and BITS retry behavior). |
ExpectedUpdateHosts | Allow-list of corporate update/CDN endpoints that legitimately use BITS (WSUS, MEMCM, vendor updaters). |
SuspiciousCliSwitches | BITSAdmin flags of interest (/transfer, /addfile, /SetNotifyCmdLine, /resume, /setcustomheaders, /setminretrydelay). |
NotifyCmdBlockList | Known risky binaries or folders (e.g., %TEMP%\*.exe, powershell.exe, cmd.exe) used as BITS notify commands. |
UserContext | Scope by interactive users, service accounts, or high-value targets (admins/servers) to reduce benign noise. |
ExternalNetCIDRs | Definition of external/non-corp destinations for network correlation. |
JobLifetimeThreshold | Maximum age or retry count for benign jobs before flagging persistence (e.g., >3 days or retry>20). |