Windows Process Creation: bitsadmin.exe BITS jobs with SetNotifyCmdLine or remote file additions
Alerts on bitsadmin.exe command lines using /SetNotifyCmdLine or /Addfile to execute after download or stage remote files.
- Product
- windows
- Category
- process_creation
- Author
- Sreeman (SigmaHQ), DRL 1.1
- Published
- 2020-10-29
- Updated
- 2026-07-31
ATT&CK techniques
Execution → Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows process creation where bitsadmin.exe is executed with parameters used to set a notification command or add remote files for transfer. BITS jobs can be abused to chain downloads of additional payloads and then execute a specified command after the job completes, supporting stealthy execution and persistence. It relies on process creation telemetry, matching Image/OriginalFileName for bitsadmin.exe and specific command-line substrings such as /SetNotifyCmdLine, cmd.exe, regsvr32.exe, and remote URL schemes.
Reporting behind it
- fireeye.comhttps://www.fireeye.com/blog/threat-research/2020/10/kegtap-and-singlemalt-with-a-ransomware-chaser.html
- 0xthem.blogspot.comhttp://0xthem.blogspot.com/2014/03/t-emporal-persistence-with-and-schtasks.html
- isc.sans.eduhttps://isc.sans.edu/diary/Wipe+the+drive+Stealthy+Malware+Persistence+Mechanism+-+Part+1/15394
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_bitsadmin_potential_persistence.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Process Creation: bitsadmin.exe BITS jobs with SetNotifyCmdLine or remote file additions"
id: 2b4ceded-2ed0-4fd2-92a6-c529b7a3f35c
status: test
description: This rule flags Windows process creation where bitsadmin.exe is executed with parameters used to set a notification command or add remote files for transfer. BITS jobs can be abused to chain downloads of additional payloads and then execute a specified command after the job completes, supporting stealthy execution and persistence. It relies on process creation telemetry, matching Image/OriginalFileName for bitsadmin.exe and specific command-line substrings such as /SetNotifyCmdLine, cmd.exe, regsvr32.exe, and remote URL schemes.
references:
- https://www.fireeye.com/blog/threat-research/2020/10/kegtap-and-singlemalt-with-a-ransomware-chaser.html
- http://0xthem.blogspot.com/2014/03/t-emporal-persistence-with-and-schtasks.html
- https://isc.sans.edu/diary/Wipe+the+drive+Stealthy+Malware+Persistence+Mechanism+-+Part+1/15394
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_bitsadmin_potential_persistence.yml
author: Sreeman, Huntrule Team
date: 2020-10-29
modified: 2024-01-25
tags:
- attack.persistence
- attack.execution
- attack.stealth
- attack.t1197
logsource:
product: windows
category: process_creation
detection:
selection_img:
- Image|endswith: \bitsadmin.exe
- OriginalFileName: bitsadmin.exe
selection_cli_notify_1:
CommandLine|contains: /SetNotifyCmdLine
selection_cli_notify_2:
CommandLine|contains:
- "%COMSPEC%"
- cmd.exe
- regsvr32.exe
selection_cli_add_1:
CommandLine|contains: /Addfile
selection_cli_add_2:
CommandLine|contains:
- "http:"
- "https:"
- "ftp:"
- "ftps:"
condition: selection_img and (all of selection_cli_notify_* or all of selection_cli_add_*)
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: b9cbbc17-d00d-4e3d-a827-b06d03d2380d
type: derived