Windows Process Creation: BITSAdmin Downloading File with Suspicious Extension

Flags bitsadmin.exe commands that transfer or add files with suspicious extensions based on process creation command-line content.

FreeReviewedSigma · High · v2

Product: windows
Category: process_creation
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2022-06-28
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Execution → C2

Recon
Resource Dev
Initial Access
Execution
- T1197BITS Jobs
Persistence
- T1197BITS Jobs
Priv Esc
Defense Evasion
- T1036.003Rename Legitimate Utilities
- T1197BITS Jobs
Cred Access
Discovery
Lateral Movement
Collection
C2
- T1105Ingress Tool Transfer
Exfiltration
Impact

What it detects

This rule flags Windows process executions of bitsadmin.exe where the command line includes transfer-related switches (/transfer, /create, /addfile) and the command line contains one of several potentially suspicious file extensions. Attackers may use BITSAdmin to stealthily download payloads or staging files, so correlating BITSAdmin activity with extension indicators can highlight likely malicious file retrieval. It relies on process creation telemetry capturing the Image/OriginalFileName of bitsadmin.exe and the full CommandLine.

Reporting behind it

Related detections9 linkedT1105 — drag to rearrange

Windows Process Creation: bitsadmin Downloads Files to Suspicious Directories

Windows BITSAdmin Downloads from File-Sharing Domains

Windows BITSAdmin File Download via bitsadmin.exe with Transfer/Addfile Arguments

Suspicious Remote Script Transfer via Bitsadmin (via process_creation)

Suspicious File Download Via Bitsadmin Transfer

BITS Payload Downloaded via Commandline (via process_creation)

BITS Payload Downloaded via PowerShell (via powershell)

Suspicious sLoad Payload Download via BITSAdmin LOLBin Transfer (via process_creation)

Suspicious File Download via Certutil URLCache

Windows Process Creation: BITSAdmin Downloading File with Suspicious Extension

Pivot detection · T1105 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-detect-bitsadmin-download-of-files-with-suspicious-extensions-5b80a791

title: "Windows Process Creation: BITSAdmin Downloading File with Suspicious Extension"
id: ca76123f-f99a-4c60-a854-a53f56e59767
status: test
description: This rule flags Windows process executions of bitsadmin.exe where the command line includes transfer-related switches (/transfer, /create, /addfile) and the command line contains one of several potentially suspicious file extensions. Attackers may use BITSAdmin to stealthily download payloads or staging files, so correlating BITSAdmin activity with extension indicators can highlight likely malicious file retrieval. It relies on process creation telemetry capturing the Image/OriginalFileName of bitsadmin.exe and the full CommandLine.
references:
  - https://blog.netspi.com/15-ways-to-download-a-file/#bitsadmin
  - https://isc.sans.edu/diary/22264
  - https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_bitsadmin_download_susp_extensions.yml
author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-06-28
modified: 2023-05-30
tags:
  - attack.persistence
  - attack.execution
  - attack.stealth
  - attack.t1197
  - attack.s0190
  - attack.t1036.003
  - attack.command-and-control
  - attack.t1105
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \bitsadmin.exe
    - OriginalFileName: bitsadmin.exe
  selection_flags:
    CommandLine|contains:
      - " /transfer "
      - " /create "
      - " /addfile "
  selection_extension:
    CommandLine|contains:
      - .7z
      - .asax
      - .ashx
      - .asmx
      - .asp
      - .aspx
      - .bat
      - .cfm
      - .cgi
      - .chm
      - .cmd
      - .dll
      - .gif
      - .jpeg
      - .jpg
      - .jsp
      - .jspx
      - .log
      - .png
      - .ps1
      - .psm1
      - .rar
      - .scf
      - .sct
      - .txt
      - .vbe
      - .vbs
      - .war
      - .wsf
      - .wsh
      - .xll
      - .zip
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_bitsadmin_download_susp_extensions/info.yml
simulation:
  - type: atomic-red-team
    name: Windows - BITSAdmin BITS Download
    technique: T1105
    atomic_guid: a1921cd3-9a2d-47d5-a891-f1d0f2a7a31b
license: DRL-1.1
related:
  - id: 5b80a791-ad9b-4b75-bcc1-ad4e1e89c200
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL