Cortex XDR
#Scenario
Hunt for adversaries abusing the Background Intelligent Transfer Service (BITS) to download malicious payloads or exfiltrate data under the radar.
markdown
> Make sure you're comfortable with the results in your own environment before using this more widely.
# Snippet - Bitsadmin file transfer
## Scenario
Scenario: imagine an operator using the Background Intelligent Transfer
Service (`bitsadmin.exe`) to stage tooling over HTTP. Like certutil, this
binary is signed, on-disk, and unlikely to be blocked, which keeps it in
rotation through 2025-2026.
Logic: legitimate Windows Update activity uses BITS but not the `bitsadmin` CLI. Operator-driven transfers stand out because they almost always invoke the `/transfer` verb with a URL.
- [https://attack.mitre.org/techniques/T1197/](https://attack.mitre.org/techniques/T1197/)
- [https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/](https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin)
xql
// Make sure you're comfortable with the results in your own environment before using this more widely.
dataset = xdr_data
| filter event_type = ENUM.PROCESS and event_sub_type = ENUM.PROCESS_START
| filter lowercase(action_process_image_name) = "bitsadmin.exe"
| filter lowercase(action_process_image_command_line) contains "/transfer"
or lowercase(action_process_image_command_line) contains "/addfile"
or lowercase(action_process_image_command_line) contains "/create"
| fields _time, agent_hostname, actor_effective_username,
causality_actor_process_image_name, action_process_image_command_line
| limit 200