Windows Process Creation: bitsadmin Downloads Files to Suspicious Directories
Flags bitsadmin.exe file downloads that target suspicious folders using /transfer, /create, and /addfile command-line parameters.
- Product
- windows
- Category
- process_creation
- Author
- Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-06-28
- Updated
- 2026-07-31
ATT&CK techniques
Execution → C2Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
This rule identifies Windows executions of bitsadmin.exe where the command line includes transfer/create/addfile operations and the destination path targets common high-value or attacker-preferred folders. Such activity matters because BITSAdmin can be abused to download and stage payloads while blending into normal Windows transfer behaviors. The detection relies on process creation telemetry with the process image name and the full command line, including both BITSAdmin switches and the targeted folder indicators.
Reporting behind it
- blog.netspi.comhttps://blog.netspi.com/15-ways-to-download-a-file/#bitsadmin
- isc.sans.eduhttps://isc.sans.edu/diary/22264
- lolbas-project.github.iohttps://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/
- blog.talosintelligence.comhttps://blog.talosintelligence.com/breaking-the-silence-recent-truebot-activity/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_bitsadmin_download_susp_targetfolder.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Process Creation: bitsadmin Downloads Files to Suspicious Directories"
id: 81ef1620-042c-40b8-9014-05bc07e166e6
related:
- id: 6e30c82f-a9f8-4aab-b79c-7c12bce6f248
type: obsolete
- id: 1cf465a1-2609-4c15-9b66-c32dbe4bfd67
type: similar
- id: 2ddef153-167b-4e89-86b6-757a9e65dcac
type: derived
status: test
description: This rule identifies Windows executions of bitsadmin.exe where the command line includes transfer/create/addfile operations and the destination path targets common high-value or attacker-preferred folders. Such activity matters because BITSAdmin can be abused to download and stage payloads while blending into normal Windows transfer behaviors. The detection relies on process creation telemetry with the process image name and the full command line, including both BITSAdmin switches and the targeted folder indicators.
references:
- https://blog.netspi.com/15-ways-to-download-a-file/#bitsadmin
- https://isc.sans.edu/diary/22264
- https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/
- https://blog.talosintelligence.com/breaking-the-silence-recent-truebot-activity/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_bitsadmin_download_susp_targetfolder.yml
author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-06-28
modified: 2025-12-10
tags:
- attack.persistence
- attack.execution
- attack.stealth
- attack.t1197
- attack.s0190
- attack.t1036.003
- attack.command-and-control
- attack.t1105
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: \bitsadmin.exe
- OriginalFileName: bitsadmin.exe
selection_flags:
CommandLine|contains:
- " /transfer "
- " /create "
- " /addfile "
selection_folder:
CommandLine|contains:
- :\Perflogs
- :\ProgramData\
- :\Temp\
- :\Users\Public\
- :\Windows\
- \$Recycle.Bin\
- \AppData\Local\
- \AppData\Roaming\
- \Contacts\
- \Desktop\
- \Favorites\
- \Favourites\
- \inetpub\wwwroot\
- \Music\
- \Pictures\
- \Start Menu\Programs\Startup\
- \Users\Default\
- \Videos\
- "%ProgramData%"
- "%public%"
- "%temp%"
- "%tmp%"
condition: all of selection_*
falsepositives:
- Unknown
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_bitsadmin_download_susp_targetfolder/info.yml
simulation:
- type: atomic-red-team
name: Windows - BITSAdmin BITS Download
technique: T1105
atomic_guid: a1921cd3-9a2d-47d5-a891-f1d0f2a7a31b
license: DRL-1.1