Windows Process Creation: bitsadmin Downloads Files to Suspicious Directories

Flags bitsadmin.exe file downloads that target suspicious folders using /transfer, /create, and /addfile command-line parameters.

FreeReviewedSigma · High · v2

Product: windows
Category: process_creation
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2022-06-28
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Execution → C2

Recon
Resource Dev
Initial Access
Execution
- T1197BITS Jobs
Persistence
- T1197BITS Jobs
Priv Esc
Defense Evasion
- T1036.003Rename Legitimate Utilities
- T1197BITS Jobs
Cred Access
Discovery
Lateral Movement
Collection
C2
- T1105Ingress Tool Transfer
Exfiltration
Impact

What it detects

This rule identifies Windows executions of bitsadmin.exe where the command line includes transfer/create/addfile operations and the destination path targets common high-value or attacker-preferred folders. Such activity matters because BITSAdmin can be abused to download and stage payloads while blending into normal Windows transfer behaviors. The detection relies on process creation telemetry with the process image name and the full command line, including both BITSAdmin switches and the targeted folder indicators.

Reporting behind it

Related detections9 linkedT1105 — drag to rearrange

Windows Process Creation: BITSAdmin Downloading File with Suspicious Extension

Windows BITSAdmin Downloads from File-Sharing Domains

Windows BITSAdmin File Download via bitsadmin.exe with Transfer/Addfile Arguments

Suspicious Remote Script Transfer via Bitsadmin (via process_creation)

Suspicious File Download Via Bitsadmin Transfer

BITS Payload Downloaded via Commandline (via process_creation)

BITS Payload Downloaded via PowerShell (via powershell)

Suspicious sLoad Payload Download via BITSAdmin LOLBin Transfer (via process_creation)

Suspicious File Download via Certutil URLCache

Windows Process Creation: bitsadmin Downloads Files to Suspicious Directories

Pivot detection · T1105 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-process-creation-bitsadmin-downloading-to-suspicious-target-folders-2ddef153

title: "Windows Process Creation: bitsadmin Downloads Files to Suspicious Directories"
id: 81ef1620-042c-40b8-9014-05bc07e166e6
related:
  - id: 6e30c82f-a9f8-4aab-b79c-7c12bce6f248
    type: obsolete
  - id: 1cf465a1-2609-4c15-9b66-c32dbe4bfd67
    type: similar
  - id: 2ddef153-167b-4e89-86b6-757a9e65dcac
    type: derived
status: test
description: This rule identifies Windows executions of bitsadmin.exe where the command line includes transfer/create/addfile operations and the destination path targets common high-value or attacker-preferred folders. Such activity matters because BITSAdmin can be abused to download and stage payloads while blending into normal Windows transfer behaviors. The detection relies on process creation telemetry with the process image name and the full command line, including both BITSAdmin switches and the targeted folder indicators.
references:
  - https://blog.netspi.com/15-ways-to-download-a-file/#bitsadmin
  - https://isc.sans.edu/diary/22264
  - https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/
  - https://blog.talosintelligence.com/breaking-the-silence-recent-truebot-activity/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_bitsadmin_download_susp_targetfolder.yml
author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-06-28
modified: 2025-12-10
tags:
  - attack.persistence
  - attack.execution
  - attack.stealth
  - attack.t1197
  - attack.s0190
  - attack.t1036.003
  - attack.command-and-control
  - attack.t1105
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \bitsadmin.exe
    - OriginalFileName: bitsadmin.exe
  selection_flags:
    CommandLine|contains:
      - " /transfer "
      - " /create "
      - " /addfile "
  selection_folder:
    CommandLine|contains:
      - :\Perflogs
      - :\ProgramData\
      - :\Temp\
      - :\Users\Public\
      - :\Windows\
      - \$Recycle.Bin\
      - \AppData\Local\
      - \AppData\Roaming\
      - \Contacts\
      - \Desktop\
      - \Favorites\
      - \Favourites\
      - \inetpub\wwwroot\
      - \Music\
      - \Pictures\
      - \Start Menu\Programs\Startup\
      - \Users\Default\
      - \Videos\
      - "%ProgramData%"
      - "%public%"
      - "%temp%"
      - "%tmp%"
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_bitsadmin_download_susp_targetfolder/info.yml
simulation:
  - type: atomic-red-team
    name: Windows - BITSAdmin BITS Download
    technique: T1105
    atomic_guid: a1921cd3-9a2d-47d5-a891-f1d0f2a7a31b
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL