BITS job creation or notify command set from the command line

Siemphony@siemphonymediumT1197verified in labPlaybook · Command and control

Matches the first step of AN0274's chain — a BITS job being created or reconfigured — at process creation, either through bitsadmin.exe carrying one of the switches MITRE lists under its `SuspiciousCliSwitches` knob (/transfer, /addfile, /SetNotifyCmdLine, /resume, /setcustomheaders, /setminretrydelay, used here exactly as MITRE gives them) or through the BITS PowerShell cmdlets, whose names are authored here. Both legs are written with `|windash` where the switch is dash-like, so the slash and dash spellings and the Unicode dashes all match. The analytic's other log sources are deliberately not used, and the reason matters more than the rule: BITS transfers are performed by the BITS service inside `svchost.exe -k netsvcs`, not by the process that queued the job, so a Sysmon EventID 3 or EventID 22 rule keyed on bitsadmin.exe would translate cleanly into every backend and never match a single event. AN0274 says this itself when it describes the notify command being launched from svchost. Two further gaps are structural. A job created through the COM interface directly, which is how tooling more capable than bitsadmin does it, produces no command line at all and is invisible here; and the correlation MITRE actually asks for — job creation, then a transfer, then the notify command firing hours later — needs a timeframe, so the `TimeWindow`, `JobLifetimeThreshold` and `ExpectedUpdateHosts` knobs all have to be applied downstream rather than in this rule. The rule is written in the Sysmon EventID 1 process_creation vocabulary (`Image`, `CommandLine`); the log source AN0274 names is Security 4688, where the same values arrive as `NewProcessName` and need mapping onto `Image` first, and where the command line is only present if both the *Audit Process Creation* policy and the separate *Include command line in process creation events* policy are enabled — neither is on in a default install or in the MS and CIS baselines, and without them this rule returns zero rows, which reads as quiet when it means blind. UNVERIFIED — derived from MITRE ATT&CK DET0098 and never executed against logs.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

1title: BITS job creation or notify command set from the command line2id: dc55b732-9417-4838-ac13-9f5a2d83331a3status: experimental4description: |5  Matches the first step of AN0274's chain — a BITS job being created or6  reconfigured — at process creation, either through bitsadmin.exe carrying one7  of the switches MITRE lists under its `SuspiciousCliSwitches` knob8  (/transfer, /addfile, /SetNotifyCmdLine, /resume, /setcustomheaders,9  /setminretrydelay, used here exactly as MITRE gives them) or through the BITS10  PowerShell cmdlets, whose names are authored here. Both legs are written with11  `|windash` where the switch is dash-like, so the slash and dash spellings and12  the Unicode dashes all match. The analytic's other log sources are13  deliberately not used, and the reason matters more than the rule: BITS14  transfers are performed by the BITS service inside `svchost.exe -k netsvcs`,15  not by the process that queued the job, so a Sysmon EventID 3 or EventID 2216  rule keyed on bitsadmin.exe would translate cleanly into every backend and17  never match a single event. AN0274 says this itself when it describes the18  notify command being launched from svchost. Two further gaps are structural.19  A job created through the COM interface directly, which is how tooling more20  capable than bitsadmin does it, produces no command line at all and is21  invisible here; and the correlation MITRE actually asks for — job creation,22  then a transfer, then the notify command firing hours later — needs a23  timeframe, so the `TimeWindow`, `JobLifetimeThreshold` and24  `ExpectedUpdateHosts` knobs all have to be applied downstream rather than in25  this rule. The rule is written in the Sysmon EventID 1 process_creation26  vocabulary (`Image`, `CommandLine`); the log source AN0274 names is Security27  4688, where the same values arrive as `NewProcessName` and need mapping onto28  `Image` first, and where the command line is only present if both the *Audit29  Process Creation* policy and the separate *Include command line in process30  creation events* policy are enabled — neither is on in a default install or31  in the MS and CIS baselines, and without them this rule returns zero rows,32  which reads as quiet when it means blind.33  UNVERIFIED — derived from MITRE ATT&CK DET0098 and never executed against logs.34references:35  - https://attack.mitre.org/techniques/T119736  - https://attack.mitre.org/detectionstrategies/DET009837author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)38date: 2026-08-1639tags:40  - attack.defense-evasion41  - attack.persistence42  - attack.execution43  - attack.t119744logsource:45  category: process_creation46  product: windows47detection:48  selection_bitsadmin:49    Image|endswith: '\bitsadmin.exe'50    CommandLine|contains|windash:51      - '/transfer'52      - '/addfile'53      - '/setnotifycmdline'54      - '/resume'55      - '/setcustomheaders'56      - '/setminretrydelay'57  selection_ps_host:58    Image|endswith:59      - '\powershell.exe'60      - '\pwsh.exe'61  selection_ps_bits:62    CommandLine|contains:63      - 'Start-BitsTransfer'64      - 'Add-BitsFile'65      - 'Set-BitsTransfer'66      - 'Complete-BitsTransfer'67  condition: selection_bitsadmin or (selection_ps_host and selection_ps_bits)68falsepositives:69  - "Software distribution, patching and imaging that still shells out to bitsadmin /transfer to stage a package. Configuration-management task sequences, vendor updaters and OS deployment scripts all do this, and on any estate running one of them it is the rule's top talker by a clear margin; MITRE's ExpectedUpdateHosts knob is aimed at exactly this, but the destination is not on the process-creation event, so the allowlist has to key on the parent process or the service account instead."70  - "Administrators and helpdesk runbooks using Start-BitsTransfer, which is the supported PowerShell way to download a file on a server and appears in a great many internal scripts, module bootstrappers and vendor installation guides."71  - "Backup, log-shipping and content-replication jobs that use /resume or /setminretrydelay to nurse a large transfer over a slow or intermittent link, producing repeated matches from the same account on a fixed schedule."72level: medium

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where ((FolderPath endswith "\\bitsadmin.exe" and (ProcessCommandLine contains "-transfer" or ProcessCommandLine contains "/transfer" or ProcessCommandLine contains "–transfer" or ProcessCommandLine contains "—transfer" or ProcessCommandLine contains "―transfer" or ProcessCommandLine contains "-addfile" or ProcessCommandLine contains "/addfile" or ProcessCommandLine contains "–addfile" or ProcessCommandLine contains "—addfile" or ProcessCommandLine contains "―addfile" or ProcessCommandLine contains "-setnotifycmdline" or ProcessCommandLine contains "/setnotifycmdline" or ProcessCommandLine contains "–setnotifycmdline" or ProcessCommandLine contains "—setnotifycmdline" or ProcessCommandLine contains "―setnotifycmdline" or ProcessCommandLine contains "-resume" or ProcessCommandLine contains "/resume" or ProcessCommandLine contains "–resume" or ProcessCommandLine contains "—resume" or ProcessCommandLine contains "―resume" or ProcessCommandLine contains "-setcustomheaders" or ProcessCommandLine contains "/setcustomheaders" or ProcessCommandLine contains "–setcustomheaders" or ProcessCommandLine contains "—setcustomheaders" or ProcessCommandLine contains "―setcustomheaders" or ProcessCommandLine contains "-setminretrydelay" or ProcessCommandLine contains "/setminretrydelay" or ProcessCommandLine contains "–setminretrydelay" or ProcessCommandLine contains "—setminretrydelay" or ProcessCommandLine contains "―setminretrydelay")) or ((FolderPath endswith "\\powershell.exe" or FolderPath endswith "\\pwsh.exe") and (ProcessCommandLine contains "Start-BitsTransfer" or ProcessCommandLine contains "Add-BitsFile" or ProcessCommandLine contains "Set-BitsTransfer" or ProcessCommandLine contains "Complete-BitsTransfer")))

Splunk · SPL

Run this as a search.

index=* ((Image="*\\bitsadmin.exe" AND (CommandLine="*-transfer*" OR CommandLine="*/transfer*" OR CommandLine="*–transfer*" OR CommandLine="*—transfer*" OR CommandLine="*―transfer*" OR CommandLine="*-addfile*" OR CommandLine="*/addfile*" OR CommandLine="*–addfile*" OR CommandLine="*—addfile*" OR CommandLine="*―addfile*" OR CommandLine="*-setnotifycmdline*" OR CommandLine="*/setnotifycmdline*" OR CommandLine="*–setnotifycmdline*" OR CommandLine="*—setnotifycmdline*" OR CommandLine="*―setnotifycmdline*" OR CommandLine="*-resume*" OR CommandLine="*/resume*" OR CommandLine="*–resume*" OR CommandLine="*—resume*" OR CommandLine="*―resume*" OR CommandLine="*-setcustomheaders*" OR CommandLine="*/setcustomheaders*" OR CommandLine="*–setcustomheaders*" OR CommandLine="*—setcustomheaders*" OR CommandLine="*―setcustomheaders*" OR CommandLine="*-setminretrydelay*" OR CommandLine="*/setminretrydelay*" OR CommandLine="*–setminretrydelay*" OR CommandLine="*—setminretrydelay*" OR CommandLine="*―setminretrydelay*")) OR ((Image="*\\powershell.exe" OR Image="*\\pwsh.exe") AND (CommandLine="*Start-BitsTransfer*" OR CommandLine="*Add-BitsFile*" OR CommandLine="*Set-BitsTransfer*" OR CommandLine="*Complete-BitsTransfer*")))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((TO_LOWER(process.executable) LIKE "*\\\\bitsadmin.exe" AND (TO_LOWER(process.command_line) LIKE "*-transfer*" OR TO_LOWER(process.command_line) LIKE "*/transfer*" OR TO_LOWER(process.command_line) LIKE "*–transfer*" OR TO_LOWER(process.command_line) LIKE "*—transfer*" OR TO_LOWER(process.command_line) LIKE "*―transfer*" OR TO_LOWER(process.command_line) LIKE "*-addfile*" OR TO_LOWER(process.command_line) LIKE "*/addfile*" OR TO_LOWER(process.command_line) LIKE "*–addfile*" OR TO_LOWER(process.command_line) LIKE "*—addfile*" OR TO_LOWER(process.command_line) LIKE "*―addfile*" OR TO_LOWER(process.command_line) LIKE "*-setnotifycmdline*" OR TO_LOWER(process.command_line) LIKE "*/setnotifycmdline*" OR TO_LOWER(process.command_line) LIKE "*–setnotifycmdline*" OR TO_LOWER(process.command_line) LIKE "*—setnotifycmdline*" OR TO_LOWER(process.command_line) LIKE "*―setnotifycmdline*" OR TO_LOWER(process.command_line) LIKE "*-resume*" OR TO_LOWER(process.command_line) LIKE "*/resume*" OR TO_LOWER(process.command_line) LIKE "*–resume*" OR TO_LOWER(process.command_line) LIKE "*—resume*" OR TO_LOWER(process.command_line) LIKE "*―resume*" OR TO_LOWER(process.command_line) LIKE "*-setcustomheaders*" OR TO_LOWER(process.command_line) LIKE "*/setcustomheaders*" OR TO_LOWER(process.command_line) LIKE "*–setcustomheaders*" OR TO_LOWER(process.command_line) LIKE "*—setcustomheaders*" OR TO_LOWER(process.command_line) LIKE "*―setcustomheaders*" OR TO_LOWER(process.command_line) LIKE "*-setminretrydelay*" OR TO_LOWER(process.command_line) LIKE "*/setminretrydelay*" OR TO_LOWER(process.command_line) LIKE "*–setminretrydelay*" OR TO_LOWER(process.command_line) LIKE "*—setminretrydelay*" OR TO_LOWER(process.command_line) LIKE "*―setminretrydelay*")) OR ((TO_LOWER(process.executable) LIKE "*\\\\powershell.exe" OR TO_LOWER(process.executable) LIKE "*\\\\pwsh.exe") AND (TO_LOWER(process.command_line) LIKE "*start-bitstransfer*" OR TO_LOWER(process.command_line) LIKE "*add-bitsfile*" OR TO_LOWER(process.command_line) LIKE "*set-bitstransfer*" OR TO_LOWER(process.command_line) LIKE "*complete-bitstransfer*")))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <!-- 2 rules: the Sigma condition ORs across different fields,       which one rule cannot express. Any one matching is a hit. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)\\bitsadmin\.exe$</field>    <field name="CommandLine" type="pcre2">(?i)(-transfer|/transfer|–transfer|—transfer|―transfer|-addfile|/addfile|–addfile|—addfile|―addfile|-setnotifycmdline|/setnotifycmdline|–setnotifycmdline|—setnotifycmdline|―setnotifycmdline|-resume|/resume|–resume|—resume|―resume|-setcustomheaders|/setcustomheaders|–setcustomheaders|—setcustomheaders|―setcustomheaders|-setminretrydelay|/setminretrydelay|–setminretrydelay|—setminretrydelay|―setminretrydelay)</field>    <description>BITS job creation or notify command set from the command line (1/2)</description>    <mitre>      <id>T1197</id>    </mitre>  </rule>   <rule id="100001" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)(\\powershell\.exe$|\\pwsh\.exe$)</field>    <field name="CommandLine" type="pcre2">(?i)(Start-BitsTransfer|Add-BitsFile|Set-BitsTransfer|Complete-BitsTransfer)</field>    <description>BITS job creation or notify command set from the command line (2/2)</description>    <mitre>      <id>T1197</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: medium
Category: ingress_tool_transfer
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 3 Sept 2026
Rule ID: dc55b732-9417-4838-ac13-9f5a2d83331a

ATT&CKT1197

T1197BITS Jobs

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Evidence

Verification2 runs

Verified in Siemphony lab

Security Datasets — BITS job created to download a script
passed
Siemphony IR · 3 Sept 2026
1 true · 0 false · 0.0% noise
Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
0 true · 1 false · 100.0% noise

Noise checkfires on 1 of 30

Fires on 1 of 30 ordinary behaviours the baseline holds for this log type. Each is something a managed estate does on purpose, so each is a false positive an analyst would have to close.

pc-bitsadmin-updater
A vendor updater transferring a package over BITS, which is what BITS is for.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1197, evaluated against their process_creation events.

Using it

Tuning & false positivesexperimental · 3 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Suppress on parent process and service account, not on destination. The URL is
Add /create and /complete to the bitsadmin leg and Resume-BitsTransfer to the
Promote /setnotifycmdline into its own higher-severity rule. It is the

Declared by the author

Software distribution, patching and imaging that still shells out to bitsadmin /transfer to stage a package. Configuration-management task sequences, vendor updaters and OS deployment scripts all do this, and on any estate running one of them it is the rule's top talker by a clear margin; MITRE's ExpectedUpdateHosts knob is aimed at exactly this, but the destination is not on the process-creation event, so the allowlist has to key on the parent process or the service account instead.
Administrators and helpdesk runbooks using Start-BitsTransfer, which is the supported PowerShell way to download a file on a server and appears in a great many internal scripts, module bootstrappers and vendor installation guides.
Backup, log-shipping and content-replication jobs that use /resume or /setminretrydelay to nurse a large transfer over a slow or intermittent link, producing repeated matches from the same account on a fixed schedule.

Lessoningress tool transfer

ingress tool transferAI draft — unreviewed

01 · What this rule detects

The first step of AN0274's chain — a BITS job being created or reconfigured — caught at process creation, either through bitsadmin.exe carrying one of the switches MITRE lists, or through the BITS PowerShell cmdlets. MITRE's chain has three parts: create the job, let it transfer, then have BITS launch a notify command hours later. This rule sees only the first, and why is the most useful thing in it.

02 · Telemetry you need

category: process_creation / product: windows, from AN0274's first log source, written in the Sysmon EventID 1 vocabulary (Image, CommandLine). AN0274 itself names Security 4688, where the same values arrive as NewProcessName and need mapping onto Image first, and where the command line is present only if both Audit Process Creation and Include command line in process creation events are enabled. Neither is on in a default install or in the MS and CIS baselines, and without them this rule returns zero rows — which reads as quiet when it means blind.
Why the analytic's other sources go unused: BITS transfers are performed by the BITS service inside svchost.exe -k netsvcs, not by the process that queued the job. A Sysmon EventID 3 or EventID 22 rule keyed on bitsadmin.exe would render cleanly in all four backends and never match one event. AN0274 says as much when it describes the notify command launching from svchost.

03 · How the logic works

selection_bitsadmin gates Image|endswith: '\bitsadmin.exe' together with CommandLine|contains|windash over /transfer, /addfile, /setnotifycmdline, /resume, /setcustomheaders and /setminretrydelay. That list is MITRE's SuspiciousCliSwitches knob used exactly as given. The windash modifier makes the slash, dash and Unicode-dash spellings all match. selection_ps_host is powershell.exe or pwsh.exe; selection_ps_bits is Start-BitsTransfer, Add-BitsFile, Set-BitsTransfer and Complete-BitsTransfer — cmdlet names authored here, not taken from MITRE. Condition: selection_bitsadmin or (selection_ps_host and selection_ps_bits). Three blind spots. A job built through the COM interface directly, which is how tooling more capable than bitsadmin does it, produces no command line at all. The PowerShell leg only sees a cmdlet that is on a process command line; inside a .ps1, typed into a running console, or dot-sourced from a module, it spawns no process and this rule is blind — AN0274 lists PowerShell 4103/4104, and Script Block Logging is the feed that closes that gap, in its own rule against the powershell service logsource. And MITRE's correlation needs a timeframe, so TimeWindow, JobLifetimeThreshold and ExpectedUpdateHosts must all be applied downstream.

04 · Common false positives

Software distribution, patching and imaging that still shells out to bitsadmin /transfer — task sequences, vendor updaters, OS deployment scripts. The rule's own first false positive calls this its top talker by a clear margin. Start-BitsTransfer is the supported PowerShell way to fetch a file on a server and appears in a great many internal scripts and vendor installation guides. Backup and replication jobs using /resume or /setminretrydelay to nurse a transfer over an intermittent link repeat from one account on a schedule.
level: medium is arguable, since bitsadmin is deprecated and genuinely rare on a modern estate — but those entries describe continuous volume, not occasional. low is the safer starting point until distribution hosts are allowlisted.

05 · Detection maturity

tier_1: the lowest tier — and it stays there until the rule has been run against real data. Nothing in it has met a log line.
tier_2: is a fortnight of process creation from your own estate: find which hosts and accounts generate the bitsadmin volume, allowlist them, and set the level from what survives.
tier_3: is the correlation MITRE actually described, job creation joined to the notify execution out of svchost, which is a stateful analytic rather than a Sigma rule.

Related detections4 nearby

Ranked by how alike the detection logic reads, computed offline. Proximity is not evidence — each of these carries its own verification state on its own page.

Share this rule

/u/siemphony/dc55b732-9417-4838-ac13-9f5a2d83331a

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

BITS job creation or notify command set from the command line

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it