Windows BITS job created by bitsadmin.exe (BITS Client EventID 3)

ATT&CK techniques

Execution → Defense Evasion

Recon
Resource Dev
Initial Access
Execution
- T1197BITS Jobs
Persistence
- T1197BITS Jobs
Priv Esc
Defense Evasion
- T1197BITS Jobs
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

Identifies the creation of a new Background Intelligent Transfer Service (BITS) job when the initiating process is bitsadmin.exe. Attackers can use BITS jobs to stage or transfer content while blending into normal system activity. The rule relies on Windows BITS Client telemetry (EventID 3) that includes the process path ending with \bitsadmin.exe.

Reporting behind it

Related detections9 linkedT1197 — drag to rearrange

Suspicious Remote Script Transfer via Bitsadmin (via process_creation)

Suspicious File Download Via Bitsadmin Transfer

Suspicious Executable Download via bitsadmin Transfer (via process_creation)

BITS Job Persistence via Bitsadmin Notify Command (via process_creation)

BITS Payload Downloaded via Commandline (via process_creation)

BITS Payload Downloaded via PowerShell (via powershell)

Malicious mshta.exe Spawning bitsadmin via ClickFix Phantom Meet

Suspicious BITSAdmin File Transfer Download (via process_creation)

Suspicious sLoad Payload Download via BITSAdmin LOLBin Transfer (via process_creation)

Windows BITS job created by bitsadmin.exe (BITS Client EventID 3)

Pivot detection · T1197 · 9 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-bits-job-created-via-bitsadmin-exe-bits-client-eventid-3-1ff315dc

title: Windows BITS job created by bitsadmin.exe (BITS Client EventID 3)
id: a07f7a00-9039-4003-9433-cac0c110dee5
status: test
description: Identifies the creation of a new Background Intelligent Transfer Service (BITS) job when the initiating process is bitsadmin.exe. Attackers can use BITS jobs to stage or transfer content while blending into normal system activity. The rule relies on Windows BITS Client telemetry (EventID 3) that includes the process path ending with \bitsadmin.exe.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1197/T1197.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/bits_client/win_bits_client_new_job_via_bitsadmin.yml
author: frack113, Huntrule Team
date: 2022-03-01
modified: 2023-03-27
tags:
  - attack.persistence
  - attack.execution
  - attack.stealth
  - attack.t1197
logsource:
  product: windows
  service: bits-client
detection:
  selection:
    EventID: 3
    processPath|endswith: \bitsadmin.exe
  condition: selection
falsepositives:
  - Many legitimate applications or scripts could leverage "bitsadmin". This event is best correlated with EID 16403 via the JobID field
level: low
license: DRL-1.1
related:
  - id: 1ff315dc-2a3a-4b71-8dde-873818d25d39
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL