Windows BITS Job Creation Triggered by PowerShell

Flags new BITS job creation on Windows when initiated by PowerShell (Event ID 3).

FreeReviewedSigma · Low · v2

Product: windows
Service: bits-client
Author: frack113 (SigmaHQ), DRL 1.1
Published: 2022-03-01
Updated: 2026-07-31

ATT&CK techniques

Execution → Defense Evasion

Recon
Resource Dev
Initial Access
Execution
- T1197BITS Jobs
Persistence
- T1197BITS Jobs
Priv Esc
Defense Evasion
- T1197BITS Jobs
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies creation of a new Background Intelligent Transfer Service (BITS) job when the initiating process is PowerShell (powershell.exe or pwsh.exe). Creating BITS jobs can help attackers persist or execute transfers stealthily by leveraging Windows background services. It relies on Windows BITS-Client telemetry that records job creation events along with the process path used to start the action.

Reporting behind it

Related detections9 linkedT1197 — drag to rearrange

Suspicious Remote Script Transfer via Bitsadmin (via process_creation)

Suspicious File Download Via Bitsadmin Transfer

Suspicious Executable Download via bitsadmin Transfer (via process_creation)

BITS Job Persistence via Bitsadmin Notify Command (via process_creation)

BITS Payload Downloaded via Commandline (via process_creation)

BITS Payload Downloaded via PowerShell (via powershell)

Malicious mshta.exe Spawning bitsadmin via ClickFix Phantom Meet

Suspicious BITSAdmin File Transfer Download (via process_creation)

Suspicious sLoad Payload Download via BITSAdmin LOLBin Transfer (via process_creation)

Windows BITS Job Creation Triggered by PowerShell

Pivot detection · T1197 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-powershell-created-new-bits-job-event-id-3-fe3a2d49

title: Windows BITS Job Creation Triggered by PowerShell
id: 077331a3-b9a7-4dc4-94c2-04d217daacb8
status: test
description: This rule identifies creation of a new Background Intelligent Transfer Service (BITS) job when the initiating process is PowerShell (powershell.exe or pwsh.exe). Creating BITS jobs can help attackers persist or execute transfers stealthily by leveraging Windows background services. It relies on Windows BITS-Client telemetry that records job creation events along with the process path used to start the action.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1197/T1197.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/bits_client/win_bits_client_new_job_via_powershell.yml
author: frack113, Huntrule Team
date: 2022-03-01
modified: 2023-03-27
tags:
  - attack.persistence
  - attack.execution
  - attack.stealth
  - attack.t1197
logsource:
  product: windows
  service: bits-client
detection:
  selection:
    EventID: 3
    processPath|endswith:
      - \powershell.exe
      - \pwsh.exe
  condition: selection
falsepositives:
  - Administrator PowerShell scripts
level: low
license: DRL-1.1
related:
  - id: fe3a2d49-f255-4d10-935c-bda7391108eb
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL