BITSAdmin

BITSAdmin is a command line tool used to create and manage BITS Jobs. [1]

ID: S0190
Type: TOOL
Platforms: Windows
Contributors: Edward Millington
Version: 1.2
Created: 18 April 2018
Last Modified: 20 March 2020

Techniques Used

Domain ID Name Use
Enterprise T1197 BITS Jobs

BITSAdmin can be used to create BITS Jobs to launch a malicious process.[2]

Enterprise T1048 .003 Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol

BITSAdmin can be used to create BITS Jobs to upload files from a compromised host.[1]

Enterprise T1105 Ingress Tool Transfer

BITSAdmin can be used to create BITS Jobs to upload and/or download files.[1]

Enterprise T1570 Lateral Tool Transfer

BITSAdmin can be used to create BITS Jobs to upload and/or download files from SMB file servers.[3]

Groups That Use This Software

ID Name References
G0065 Leviathan

[4]

G0081 Tropic Trooper

[2]

G0096 APT41

[5]

References