Detecting and Mitigating BITS Jobs Abuse (T1197)

BITS Jobs (MITRE ATT&CK T1197) is the abuse of the Windows Background Intelligent Transfer Service to run code, download files and persist. MITRE files it under Stealth, Persistence and Execution, and lists Windows as the platform.

BITS is a normal Windows component, and that is why attackers like it.

How attackers use it

BITS is a low-bandwidth, asynchronous file transfer mechanism exposed through COM. Updaters, messengers and other apps use it to move data in the background using idle bandwidth. A transfer task is a BITS job, which holds a queue of one or more file operations. Jobs can be managed through PowerShell and the BITSAdmin tool.

MITRE documents these abuses:

• Download, execute and clean up. Adversaries can use BITS to download a payload, run code and remove traces. The tasks live in the BITS job database, with no new files or registry changes, and are often permitted by host firewalls.
• Persistence. Jobs can be long-lived (the default maximum lifetime is 90 days and can be extended), and a job can launch an arbitrary program when it completes or fails, including after a reboot.
• Exfiltration. BITS upload can be used to send data out over an alternative protocol.

MITRE's page lists multiple groups and malware families that used BITSAdmin or the BITS service to download payloads or to exfiltrate data.

How to detect it

MITRE's detection strategy for BITS describes this chain:

1. Someone creates or modifies a BITS job using bitsadmin.exe, the PowerShell BITS cmdlets or COM.
2. The job moves data over HTTP(S) or SMB while the owning user is logged on.
3. When the job completes or errors, BITS launches a notify command (SetNotifyCmdLine) from svchost.exe -k netsvcs -s BITS. Long-lived jobs may be used to stay in place.

The analytic correlates process creation, command and script telemetry, BITS-Client operational events and network connections started by BITS.

Practical sources: process creation logs showing bitsadmin.exe with transfer arguments, PowerShell logging for BITS cmdlets, the Microsoft-Windows-Bits-Client/Operational event log, and proxy or firewall logs for BITS downloads from unusual hosts. A child process of the BITS service host is an especially interesting event.

How to reduce the risk

MITRE lists:

• Filter network traffic. Change network and host firewall rules and other controls so that only legitimate BITS traffic is allowed.
• Tune operating system configuration. Consider reducing the default BITS job lifetime in Group Policy, or through the JobInactivityTimeout and MaxDownloadTime registry values under HKLM\Software\Policies\Microsoft\Windows\BITS.
• Limit access to the BITS interface to specific users or groups.

Check your own environment

All of these are read-only. In an elevated prompt, list BITS jobs for all users:

bitsadmin /list /allusers /verbose

The PowerShell equivalent:

Get-BitsTransfer -AllUsers

Review the most recent BITS client events:

Get-WinEvent -LogName "Microsoft-Windows-Bits-Client/Operational" -MaxEvents 50

See whether a BITS policy is set:

reg query "HKLM\Software\Policies\Microsoft\Windows\BITS"

Then ask:

• Does any job have a notify command set?
• Are there jobs from unknown owners, or jobs that are far older than normal updater activity?
• Do the remote URLs belong to vendors you recognize?

Quick check

Sources

• MITRE ATT&CK T1197: BITS Jobs