Bitsadmin.exe

Create a bitsadmin job named 1, add cmd.exe to the job, configure the job to run the target command from an Alternate data stream, then resume and complete the job.

Use Performs execution of specified file in the alternate data stream, can be used as a defensive evasion or persistence technique.

bitsadmin /create 1 bitsadmin /addfile 1 c:\windows\system32\cmd.exe c:\data\playfolder\cmd.exe bitsadmin /SetNotifyCmdLine 1 c:\data\playfolder\1.txt:cmd.exe NULL bitsadmin /RESUME 1 bitsadmin /complete 1

Evidence

Upstream reference

Environment

Local host

Context

user

Native

ADS

MITRE

T1564.004

Detection

Sigma: github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_bitsadmin_download.yml

Sigma: github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/web/proxy_generic/proxy_ua_bitsadmin_susp_tld.yml

Sigma: github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_bitsadmin_potential_persistence.yml

Splunk: github.com/splunk/security_content/blob/3f77e24974239fcb7a339080a1a483e6bad84a82/detections/endpoint/bitsadmin_download_file.yml

IOC: Child process from bitsadmin.exe

IOC: bitsadmin creates new files

IOC: bitsadmin adds data to alternate data stream

Refs

www.slideshare.net/chrisgates/windows-attacks-at-is-the-new-black-26672679

www.youtube.com/watch?v=_8xJaaQlpBo

gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f

www.soc-labs.top/en/detections/100

lolbas-project.github.io/lolbas/Binaries/Bitsadmin/

Create a bitsadmin job named 1, add cmd.exe to the job, configure the job to run the target command, then resume and complete the job.

Use Download file from Internet

bitsadmin /create 1 bitsadmin /addfile 1 https://live.sysinternals.com/autoruns.exe c:\data\playfolder\autoruns.exe bitsadmin /RESUME 1 bitsadmin /complete 1

Evidence

Upstream reference

Environment

Local host

Context

user

Native

Download

MITRE

T1105

Detection

Sigma: github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_bitsadmin_download.yml

Sigma: github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/web/proxy_generic/proxy_ua_bitsadmin_susp_tld.yml

Sigma: github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_bitsadmin_potential_persistence.yml

Splunk: github.com/splunk/security_content/blob/3f77e24974239fcb7a339080a1a483e6bad84a82/detections/endpoint/bitsadmin_download_file.yml

IOC: Child process from bitsadmin.exe

IOC: bitsadmin creates new files

IOC: bitsadmin adds data to alternate data stream

Refs

www.slideshare.net/chrisgates/windows-attacks-at-is-the-new-black-26672679

www.youtube.com/watch?v=_8xJaaQlpBo

gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f

www.soc-labs.top/en/detections/100

lolbas-project.github.io/lolbas/Binaries/Bitsadmin/

Command for copying cmd.exe to another folder

Use Copy file

bitsadmin /create 1 & bitsadmin /addfile 1 c:\windows\system32\cmd.exe c:\data\playfolder\cmd.exe & bitsadmin /RESUME 1 & bitsadmin /Complete 1 & bitsadmin /reset

Evidence

Upstream reference

Environment

Local host

Context

user

Native

Copy

MITRE

T1105

Detection

Sigma: github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_bitsadmin_download.yml

Sigma: github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/web/proxy_generic/proxy_ua_bitsadmin_susp_tld.yml

Sigma: github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_bitsadmin_potential_persistence.yml

Splunk: github.com/splunk/security_content/blob/3f77e24974239fcb7a339080a1a483e6bad84a82/detections/endpoint/bitsadmin_download_file.yml

IOC: Child process from bitsadmin.exe

IOC: bitsadmin creates new files

IOC: bitsadmin adds data to alternate data stream

Refs

www.slideshare.net/chrisgates/windows-attacks-at-is-the-new-black-26672679

www.youtube.com/watch?v=_8xJaaQlpBo

gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f

www.soc-labs.top/en/detections/100

lolbas-project.github.io/lolbas/Binaries/Bitsadmin/

One-liner that creates a bitsadmin job named 1, add cmd.exe to the job, configure the job to run the target command, then resume and complete the job.

Use Execute binary file specified. Can be used as a defensive evasion.

bitsadmin /create 1 & bitsadmin /addfile 1 c:\windows\system32\cmd.exe c:\data\playfolder\cmd.exe & bitsadmin /SetNotifyCmdLine 1 c:\data\playfolder\cmd.exe NULL & bitsadmin /RESUME 1 & bitsadmin /Reset

Evidence

Upstream reference

Environment

Local host

Context

user

Native

Execute

MITRE

T1218

Detection

Sigma: github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_bitsadmin_download.yml

Sigma: github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/web/proxy_generic/proxy_ua_bitsadmin_susp_tld.yml

Sigma: github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_bitsadmin_potential_persistence.yml

Splunk: github.com/splunk/security_content/blob/3f77e24974239fcb7a339080a1a483e6bad84a82/detections/endpoint/bitsadmin_download_file.yml

IOC: Child process from bitsadmin.exe

IOC: bitsadmin creates new files

IOC: bitsadmin adds data to alternate data stream

Refs

www.slideshare.net/chrisgates/windows-attacks-at-is-the-new-black-26672679

www.youtube.com/watch?v=_8xJaaQlpBo

gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f

www.soc-labs.top/en/detections/100

lolbas-project.github.io/lolbas/Binaries/Bitsadmin/