ATT&CK technique

T1197

BITS Jobs

StealthPersistenceExecution 23 detections found

Detection rules

Source	Rule	Status	Updated
splunk	PowerShell Start-BitsTransfer	production	2026-10-09
splunk	BITSAdmin Download File	production	2026-10-02
splunk	BITS Job Persistence	production	2026-10-02
sigma	Bitsadmin to Uncommon TLD	test	2026-09-30
splunk	Cisco NVM - Curl Execution With Insecure Flags	production	2026-09-22
splunk	Cisco NVM - Suspicious Download From File Sharing Website	production	2026-09-22
elastic	Ingress Transfer via Windows BITS	production	2026-09-18
elastic	Persistence via BITS Job Notify Cmdline	production	2026-09-18
sigma	BITS Transfer Job Download From File Sharing Domains	test	2026-03-29
sigma	Suspicious Download From File-Sharing Website Via Bitsadmin	test	2026-03-29
sigma	File Download Via Bitsadmin To A Suspicious Target Folder	test	2025-12-10
sigma	BITS Client BitsProxy DLL Loaded By Uncommon Process	experimental	2025-06-04
sigma	BITS Transfer Job With Uncommon Or Suspicious Remote TLD	test	2025-02-28
sigma	Monitoring For Persistence Via BITS	test	2024-01-25
sigma	File With Suspicious Extension Downloaded Via Bitsadmin	test	2023-05-30
sigma	New BITS Job Created Via Bitsadmin	test	2023-03-27
sigma	BITS Transfer Job Download From Direct IP	test	2023-03-27
sigma	BITS Transfer Job Downloading File Potential Suspicious Extension	test	2023-03-27
sigma	New BITS Job Created Via PowerShell	test	2023-03-27
sigma	BITS Transfer Job Download To Potential Suspicious Folder	test	2023-03-27
sigma	Suspicious Download From Direct IP Via Bitsadmin	test	2023-02-15
sigma	File Download Via Bitsadmin	test	2023-02-15
sigma	Bitsadmin to Uncommon IP Server Address	test	2022-08-24