BITS任务

Sub-techniques (3)

ID	Name
T1197.001	合法服务伪装BITS任务
T1197.002	加密载荷隐蔽传输
T1197.003	持久化低活跃任务链

BITS任务是攻击者滥用Windows后台智能传输服务实现持久化攻击的技术，通过创建文件传输任务执行恶意代码下载、驻留及数据渗出。传统防御手段聚焦于监控BITSAdmin工具使用、分析BITS服务日志及审查网络流量特征，依赖任务元数据异常（如非常用命令行参数）、传输目标信誉评级或未加密协议使用等特征进行检测。

为规避传统检测机制，攻击者演进形成多维度匿迹技术，通过元数据伪装、加密通信及任务链解耦等手法，将恶意行为深度嵌入系统合法后台作业流程，构建出难以通过常规审计手段发现的隐蔽攻击路径。

现有BITS任务匿迹技术的核心演进方向集中在任务生命周期管理与通信特征融合两个层面。合法服务伪装通过元数据仿冒实现任务列表的"视觉隐蔽"，使恶意任务在基础审计中呈现为可信维护作业；加密传输技术利用协议层加密与流量特征模拟，使网络监控无法有效识别恶意载荷；持久化任务链则通过时空维度分解攻击行为，将高强度攻击活动转化为低频次、长周期的离散事件。三类技术的共性在于深度利用BITS服务的设计特性（如任务自包含性、传输异步性），将攻击行为转化为符合系统管理预期的"合法"后台进程，突破传统基于行为异常性或规则匹配的检测范式。

匿迹技术的发展导致传统基于任务元数据分析或明文流量审查的防御体系逐渐失效，防御方需构建BITS任务行为基线分析、加密流量元数据关联检测等能力，并强化对任务依赖关系与生命周期模式的深度审计，实现对隐蔽BITS攻击的全链条识别。

ID: T1197

Sub-techniques: T1197.001, T1197.002, T1197.003

ⓘ

Tactics: 防御规避, 入侵维持

ⓘ

Platforms: Windows

ⓘ

Defense Bypassed: Firewall, Host forensic analysis

Contributors: Brent Murphy, Elastic; David French, Elastic; Red Canary; Ricardo Dias

Version: 1.4

Created: 18 April 2018

Last Modified: 21 April 2023

匿迹效应

效应类型	是否存在
特征伪装	✅
行为透明	❌
数据遮蔽	✅
时空释痕	✅

特征伪装

攻击者通过精确仿冒合法BITS任务的元数据属性（如名称、描述、调度参数），使恶意任务在任务列表审查中呈现为系统更新或应用程序维护进程。同时利用BITS服务与可信云服务的标准通信协议，使网络流量在协议特征层面与正常业务交互无法区分，实现攻击行为的表层特征合法化。

数据遮蔽

采用HTTPS/SMB 3.0等加密协议传输恶意载荷，使得网络流量内容无法被深度包检测设备解析。攻击者进一步通过证书欺骗与域名伪装技术，使加密会话的握手阶段特征与合法服务一致，阻碍基于SSL/TLS元数据的威胁情报匹配。

时空释痕

通过构建长周期任务链与动态重试机制，将攻击行为分散至数周甚至数月的时间跨度。单个任务的低活跃特性（如每日仅传输数KB数据）与任务间的依赖触发逻辑，使得攻击特征被稀释在系统正常后台活动的时空分布中，传统基于短周期行为分析的检测模型难以有效识别。

Procedure Examples

ID	Name	Description
G0087	APT39	APT39 has used the BITS protocol to exfiltrate stolen data from a compromised host.^[1]
G0096	APT41	APT41 used BITSAdmin to download and install payloads.^[2]^[3]
S0534	Bazar	Bazar has been downloaded via Windows BITS functionality.^[4]
S0190	BITSAdmin	BITSAdmin can be used to create BITS Jobs to launch a malicious process.^[5]
S0154	Cobalt Strike	Cobalt Strike can download a hosted "beacon" payload using BITSAdmin.^[6]^[7]^[8]
S0554	Egregor	Egregor has used BITSadmin to download and execute malicious DLLs.^[9]
S0201	JPIN	A JPIN variant downloads the backdoor payload via the BITS service.^[10]
G0065	Leviathan	Leviathan has used BITSAdmin to download additional tools.^[11]
S0652	MarkiRAT	MarkiRAT can use BITS Utility to connect with the C2 server.^[12]
G0040	Patchwork	Patchwork has used BITS jobs to download malicious payloads.^[13]
S0654	ProLock	ProLock can use BITS jobs to download its malicious payload.^[14]
S0333	UBoatRAT	UBoatRAT takes advantage of the /SetNotifyCmdLine option in BITSAdmin to ensure it stays running on a system to maintain persistence.^[15]
G0102	Wizard Spider	Wizard Spider has used batch scripts that utilizes WMIC to execute a BITSAdmin transfer of a ransomware payload to each compromised machine.^[16]

Mitigations

ID	Mitigation	Description
M1037	Filter Network Traffic	Modify network and/or host firewall rules, as well as other network controls, to only allow legitimate BITS traffic.
M1028	Operating System Configuration	Consider reducing the default BITS job lifetime in Group Policy or by editing the `JobInactivityTimeout` and `MaxDownloadTime` Registry values in `HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\BITS`.^[17]
M1018	User Account Management	Consider limiting access to the BITS interface to specific users or groups.^[18]

Detection

ID	Data Source	Data Component	Detects
DS0017	Command	Command Execution	Monitor executed commands and arguments from the BITSAdmin tool (especially the ‘Transfer’, 'Create', 'AddFile', 'SetNotifyFlags', 'SetNotifyCmdLine', 'SetMinRetryDelay', 'SetCustomHeaders', and 'Resume' command options)^[17] Admin logs, PowerShell logs, and the Windows Event log for BITS activity.^[19] Also consider investigating more detailed information about jobs by parsing the BITS job database.^[20]
DS0029	Network Traffic	Network Connection Creation	Monitor for newly constructed network activity generated by BITS. BITS jobs use HTTP(S) and SMB for remote connections and are tethered to the creating user and will only function when that user is logged on (this rule applies even if a user attaches the job to a service account).
DS0009	Process	Process Creation	Monitor for newly constructed BITS tasks to enumerate using the BITSAdmin tool (bitsadmin /list /allusers /verbose). Note: Event IDs are for Sysmon (Event ID 1 - process create) and Windows Security Log (Event ID 4688 - a new process has been created). Analytic 1 is oriented around looking for the creation of Microsoft Background Intelligent Transfer Service utility (bitsadmin.exe) processes that schedule a BITS job to persist on an endpoint. The analytic identifies the command-line parameters used to create, resume or add a file to a BITS job; these are typically seen combined in a single command-line or executed in sequence. Analytic 2 identifies Microsoft Background Intelligent Transfer Service utility `bitsadmin.exe` using the `transfer` parameter to download a remote object. In addition, look for `download` or `upload` on the command-line, the switches are not required to perform a transfer. Capture any files downloaded. Review the reputation of the IP or domain used. Typically once executed, a follow on command will be used to execute the dropped file. Network connection or file modification events related will not spawn or create from `bitsadmin.exe` , but the artifacts will appear in a parallel process of `svchost.exe` with a command-line similar to `svchost.exe -k netsvcs -s BITS` . It’s important to review all parallel and child processes to capture any behaviors and artifacts. In some suspicious and malicious instances, BITS jobs will be created. You can use `bitsadmin /list /verbose` to list out the jobs during investigation. Analytic 1 - BITS Job Persistence `(source="WinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode="1") OR (source="WinEventLog:Security" EventCode="4688") Image="C:\Windows\System32\bitsadmin.exe" AND (CommandLine= "create" OR CommandLine= "addfile" OR CommandLine= "setnotifyflags" OR CommandLine= "setnotifycmdline" OR CommandLine= "setminretrydelay" OR CommandLine= "setcustomheaders" OR CommandLine= "resume")` Analytic 2 - BITSAdmin Download File `(source="WinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode="1") OR (source="WinEventLog:Security" EventCode="4688") Image="C:\Windows\System32\bitsadmin.exe" AND CommandLine= transfer`
DS0019	Service	Service Metadata	BITS runs as a service and its status can be checked with the Sc query utility (`sc query bits`).^[21]