Windows BITS Transfer Job Download to Suspicious File Paths

ATT&CK techniques

Execution → Defense Evasion

Recon
Resource Dev
Initial Access
Execution
- T1197BITS Jobs
Persistence
- T1197BITS Jobs
Priv Esc
Defense Evasion
- T1197BITS Jobs
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags new BITS transfer jobs where the saved local file path contains common attacker-preferred locations. Such activity can indicate staging or stealthy payload placement using Windows background transfer capabilities. It relies on BITS Client telemetry, specifically EventID 16403, and checks the job's LocalName for matching suspicious path fragments.

Reporting behind it

Related detections9 linkedT1197 — drag to rearrange

Suspicious Remote Script Transfer via Bitsadmin (via process_creation)

Suspicious File Download Via Bitsadmin Transfer

Suspicious Executable Download via bitsadmin Transfer (via process_creation)

BITS Job Persistence via Bitsadmin Notify Command (via process_creation)

BITS Payload Downloaded via Commandline (via process_creation)

BITS Payload Downloaded via PowerShell (via powershell)

Malicious mshta.exe Spawning bitsadmin via ClickFix Phantom Meet

Suspicious BITSAdmin File Transfer Download (via process_creation)

Suspicious sLoad Payload Download via BITSAdmin LOLBin Transfer (via process_creation)

Windows BITS Transfer Job Download to Suspicious File Paths

Pivot detection · T1197 · 9 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-bits-client-job-downloads-to-suspicious-saved-file-locations-f8a56cb7

title: Windows BITS Transfer Job Download to Suspicious File Paths
id: 0c596630-17ca-4c46-b1be-d7ea6d0f4872
status: test
description: This rule flags new BITS transfer jobs where the saved local file path contains common attacker-preferred locations. Such activity can indicate staging or stealthy payload placement using Windows background transfer capabilities. It relies on BITS Client telemetry, specifically EventID 16403, and checks the job's LocalName for matching suspicious path fragments.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1197/T1197.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/bits_client/win_bits_client_new_trasnfer_susp_local_folder.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-06-28
modified: 2023-03-27
tags:
  - attack.persistence
  - attack.execution
  - attack.stealth
  - attack.t1197
logsource:
  product: windows
  service: bits-client
detection:
  selection:
    EventID: 16403
    LocalName|contains:
      - \Desktop\
      - C:\Users\Public\
      - C:\PerfLogs\
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: f8a56cb7-a363-44ed-a82f-5926bb44cd05
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL