Windows Process Creation: bitsadmin.exe Persistence via SetNotifyCmdLine or /Addfile

title: "Windows Process Creation: bitsadmin.exe Persistence via SetNotifyCmdLine or /Addfile"
id: 2b4ceded-2ed0-4fd2-92a6-c529b7a3f35c
status: test
description: This rule flags Windows process creation where bitsadmin.exe is launched with BITS job parameters associated with persistence, including /SetNotifyCmdLine for post-download execution or /Addfile for scheduling remote content retrieval. Attackers can abuse these options to run additional commands after a successful download, enabling stealthy persistence and staged payload delivery. It relies on process creation telemetry capturing the Image/OriginalFileName and the full CommandLine arguments passed to bitsadmin.exe.
references:
  - https://www.fireeye.com/blog/threat-research/2020/10/kegtap-and-singlemalt-with-a-ransomware-chaser.html
  - http://0xthem.blogspot.com/2014/03/t-emporal-persistence-with-and-schtasks.html
  - https://isc.sans.edu/diary/Wipe+the+drive+Stealthy+Malware+Persistence+Mechanism+-+Part+1/15394
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_bitsadmin_potential_persistence.yml
author: Sreeman, Huntrule Team
date: 2020-10-29
modified: 2024-01-25
tags:
  - attack.persistence
  - attack.execution
  - attack.stealth
  - attack.t1197
logsource:
  product: windows
  category: process_creation
detection:
  selection_img:
    - Image|endswith: \bitsadmin.exe
    - OriginalFileName: bitsadmin.exe
  selection_cli_notify_1:
    CommandLine|contains: /SetNotifyCmdLine
  selection_cli_notify_2:
    CommandLine|contains:
      - "%COMSPEC%"
      - cmd.exe
      - regsvr32.exe
  selection_cli_add_1:
    CommandLine|contains: /Addfile
  selection_cli_add_2:
    CommandLine|contains:
      - "http:"
      - "https:"
      - "ftp:"
      - "ftps:"
  condition: selection_img and (all of selection_cli_notify_* or all of selection_cli_add_*)
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: b9cbbc17-d00d-4e3d-a827-b06d03d2380d
    type: derived