Windows BITS Transfer Job Download to Suspicious File Paths

Flags new Windows BITS transfer jobs that save downloaded files into predefined suspicious paths.

FreeReviewedSigma · High · v2

Product: windows
Service: bits-client
Author: Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2022-06-28
Updated: 2026-07-31

ATT&CK techniques

Execution → Defense Evasion

Recon
Resource Dev
Initial Access
Execution
- T1197BITS Jobs
Persistence
- T1197BITS Jobs
Priv Esc
Defense Evasion
- T1197BITS Jobs
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags new BITS transfer jobs where the saved local file path contains common attacker-preferred locations. Such activity can indicate staging or stealthy payload placement using Windows background transfer capabilities. It relies on BITS Client telemetry, specifically EventID 16403, and checks the job's LocalName for matching suspicious path fragments.

Reporting behind it

Related detections9 linkedT1197 — drag to rearrange

Suspicious Backup Exec Remote Agent Spawning Command Shell via Process Creation (via process_creation)

Suspicious BITSAdmin File Transfer Into ProgramData via Process Creation (via process_creation)

Suspicious File Download via bitsadmin Transfer by Medusa Ransomware

Suspicious bitsadmin Download of Python Payload via COLDRIVER

Suspicious Data Transfer via bitsadmin over HTTP

Suspicious SCMBanker Toolkit Staging via Bitsadmin to Public Directory

Suspicious PowerShell BITS Transfer of DLL Payload via process_creation

Suspicious DLL Download to ProgramData via Start-BitsTransfer (via process_creation)

Suspicious Remote Script Transfer via Bitsadmin (via process_creation)

Windows BITS Transfer Job Download to Suspicious File Paths

Pivot detection · T1197 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-bits-client-job-downloads-to-suspicious-saved-file-locations-f8a56cb7

title: Windows BITS Transfer Job Download to Suspicious File Paths
id: 0c596630-17ca-4c46-b1be-d7ea6d0f4872
status: test
description: This rule flags new BITS transfer jobs where the saved local file path contains common attacker-preferred locations. Such activity can indicate staging or stealthy payload placement using Windows background transfer capabilities. It relies on BITS Client telemetry, specifically EventID 16403, and checks the job's LocalName for matching suspicious path fragments.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1197/T1197.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/bits_client/win_bits_client_new_trasnfer_susp_local_folder.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-06-28
modified: 2023-03-27
tags:
  - attack.persistence
  - attack.execution
  - attack.stealth
  - attack.t1197
logsource:
  product: windows
  service: bits-client
detection:
  selection:
    EventID: 16403
    LocalName|contains:
      - \Desktop\
      - C:\Users\Public\
      - C:\PerfLogs\
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: f8a56cb7-a363-44ed-a82f-5926bb44cd05
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL