Windows BITSAdmin File Download via bitsadmin.exe with Transfer/Addfile Arguments
Flags bitsadmin.exe being started with parameters consistent with transferring/downloading files from an http URL.
- Product
- windows
- Category
- process_creation
- Author
- Michael Haag, FPT.EagleEye (SigmaHQ), DRL 1.1
- Published
- 2017-03-09
- Updated
- 2026-07-31
ATT&CK techniques
Execution → C2Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
This rule identifies process executions of bitsadmin.exe where the command line indicates a file transfer workflow (e.g., /transfer with a /create and /addfile sequence) and includes an HTTP URL. Attackers commonly use BITSAdmin to transfer content from remote locations in a way that can blend with normal Windows tooling. It relies on Windows process creation telemetry, including the executable image/filename and the full command line.
Reporting behind it
- blog.netspi.comhttps://blog.netspi.com/15-ways-to-download-a-file/#bitsadmin
- isc.sans.eduhttps://isc.sans.edu/diary/22264
- lolbas-project.github.iohttps://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_bitsadmin_download.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows BITSAdmin File Download via bitsadmin.exe with Transfer/Addfile Arguments
id: 29662efb-f11d-4d6d-a419-b1f79b104cad
status: test
description: This rule identifies process executions of bitsadmin.exe where the command line indicates a file transfer workflow (e.g., /transfer with a /create and /addfile sequence) and includes an HTTP URL. Attackers commonly use BITSAdmin to transfer content from remote locations in a way that can blend with normal Windows tooling. It relies on Windows process creation telemetry, including the executable image/filename and the full command line.
references:
- https://blog.netspi.com/15-ways-to-download-a-file/#bitsadmin
- https://isc.sans.edu/diary/22264
- https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_bitsadmin_download.yml
author: Michael Haag, FPT.EagleEye, Huntrule Team
date: 2017-03-09
modified: 2023-02-15
tags:
- attack.persistence
- attack.execution
- attack.stealth
- attack.t1197
- attack.s0190
- attack.t1036.003
- attack.command-and-control
- attack.t1105
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: \bitsadmin.exe
- OriginalFileName: bitsadmin.exe
selection_cmd:
CommandLine|contains: " /transfer "
selection_cli_1:
CommandLine|contains:
- " /create "
- " /addfile "
selection_cli_2:
CommandLine|contains: http
condition: selection_img and (selection_cmd or all of selection_cli_*)
falsepositives:
- Some legitimate apps use this, but limited.
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_bitsadmin_download/info.yml
simulation:
- type: atomic-red-team
name: Windows - BITSAdmin BITS Download
technique: T1105
atomic_guid: a1921cd3-9a2d-47d5-a891-f1d0f2a7a31b
license: DRL-1.1
related:
- id: d059842b-6b9d-4ed1-b5c3-5b89143c6ede
type: derived