Windows BITS Job Created via bitsadmin.exe (BITS-Client EventID 3)

Alerts on new BITS job creation when bitsadmin.exe triggers it (BITS-Client EventID 3).

FreeUnreviewedSigmalowv1

windows-bits-job-created-via-bitsadmin-exe-bits-client-eventid-3-1ff315dc

title: Windows BITS Job Created via bitsadmin.exe (BITS-Client EventID 3)
id: a07f7a00-9039-4003-9433-cac0c110dee5
status: test
description: This rule identifies creation of a new Background Intelligent Transfer Service (BITS) job initiated by bitsadmin.exe on Windows. Attackers and administrators alike may use BITS for stealthy execution and transfer behavior, so new job creation is a useful indicator for persistence or staged activity. The detection relies on BITS-Client telemetry for EventID 3 and matches the launching process path ending with bitsadmin.exe.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1197/T1197.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/bits_client/win_bits_client_new_job_via_bitsadmin.yml
author: frack113, Huntrule Team
date: 2022-03-01
modified: 2023-03-27
tags:
  - attack.persistence
  - attack.execution
  - attack.stealth
  - attack.t1197
logsource:
  product: windows
  service: bits-client
detection:
  selection:
    EventID: 3
    processPath|endswith: \bitsadmin.exe
  condition: selection
falsepositives:
  - Many legitimate applications or scripts could leverage "bitsadmin". This event is best correlated with EID 16403 via the JobID field
level: low
license: DRL-1.1
related:
  - id: 1ff315dc-2a3a-4b71-8dde-873818d25d39
    type: derived

What it detects

This rule identifies creation of a new Background Intelligent Transfer Service (BITS) job initiated by bitsadmin.exe on Windows. Attackers and administrators alike may use BITS for stealthy execution and transfer behavior, so new job creation is a useful indicator for persistence or staged activity. The detection relies on BITS-Client telemetry for EventID 3 and matches the launching process path ending with bitsadmin.exe.

Known false positives

Many legitimate applications or scripts could leverage "bitsadmin". This event is best correlated with EID 16403 via the JobID field

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.