Windows BITS Transfer Jobs Downloading Files with Suspicious Extensions

Flags Windows BITS transfers saving local files with high-risk script/executable extensions while excluding common benign patterns.

FreeReviewedSigma · Medium · v2

Product: windows
Service: bits-client
Author: frack113 (SigmaHQ), DRL 1.1
Published: 2022-03-01
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Execution → Defense Evasion

Recon
Resource Dev
Initial Access
Execution
- T1197BITS Jobs
Persistence
- T1197BITS Jobs
Priv Esc
Defense Evasion
- T1197BITS Jobs
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies BITS transfer client activity (EventID 16403) where the job writes a local file ending with high-risk executable or script extensions such as .bat, .dll, .exe, .hta, .ps1, .psd1, .sh, .vbe, and .vbs. Attackers may use BITS to stealthily fetch payloads or staging files that later execute. The rule relies on Windows BITS client telemetry that includes the local destination name and applies an optional exclusion when the destination is under AppData and the remote name contains .com.

Reporting behind it

Related detections9 linkedT1197 — drag to rearrange

Suspicious Remote Script Transfer via Bitsadmin (via process_creation)

Suspicious File Download Via Bitsadmin Transfer

Suspicious Executable Download via bitsadmin Transfer (via process_creation)

BITS Job Persistence via Bitsadmin Notify Command (via process_creation)

BITS Payload Downloaded via Commandline (via process_creation)

BITS Payload Downloaded via PowerShell (via powershell)

Malicious mshta.exe Spawning bitsadmin via ClickFix Phantom Meet

Suspicious BITSAdmin File Transfer Download (via process_creation)

Suspicious sLoad Payload Download via BITSAdmin LOLBin Transfer (via process_creation)

Windows BITS Transfer Jobs Downloading Files with Suspicious Extensions

Pivot detection · T1197 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-bits-transfer-job-writing-files-with-suspicious-executable-extensions-b85e5894

title: Windows BITS Transfer Jobs Downloading Files with Suspicious Extensions
id: b7835256-416b-48ee-a38f-ec501c580889
status: test
description: This rule identifies BITS transfer client activity (EventID 16403) where the job writes a local file ending with high-risk executable or script extensions such as .bat, .dll, .exe, .hta, .ps1, .psd1, .sh, .vbe, and .vbs. Attackers may use BITS to stealthily fetch payloads or staging files that later execute. The rule relies on Windows BITS client telemetry that includes the local destination name and applies an optional exclusion when the destination is under AppData and the remote name contains .com.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1197/T1197.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/bits_client/win_bits_client_new_transfer_saving_susp_extensions.yml
author: frack113, Huntrule Team
date: 2022-03-01
modified: 2023-03-27
tags:
  - attack.persistence
  - attack.execution
  - attack.stealth
  - attack.t1197
logsource:
  product: windows
  service: bits-client
detection:
  selection:
    EventID: 16403
    LocalName|endswith:
      - .bat
      - .dll
      - .exe
      - .hta
      - .ps1
      - .psd1
      - .sh
      - .vbe
      - .vbs
  filter_optional_generic:
    LocalName|contains: \AppData\
    RemoteName|contains: .com
  condition: selection and not 1 of filter_optional_*
falsepositives:
  - While the file extensions in question can be suspicious at times. It's best to add filters according to your environment to avoid large amount false positives
level: medium
license: DRL-1.1
related:
  - id: b85e5894-9b19-4d86-8c87-a2f3b81f0521
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL