Identifier / Programs / Windows

bitsadmin.exe

Bitsadmin is a command-line tool used to create, download or upload jobs, and to monitor their progress. Windows commands reference

LOLBAS ADS, Download, Copy, Execute 27 Sigma rules name it 5 ATT&CK techniques 4 documented commands 12 known copies with hashes

How bitsadmin.exe is abused

documented by LOLBAS

ADS T1564.004 Hide Artifacts: NTFS File Attributes

null

-create

-addfile

-setnotifycmdline

-resume

-complete

Download T1105 Ingress Tool Transfer

-create

-addfile

-resume

-complete

Copy T1105 Ingress Tool Transfer

-create

-addfile

-resume

-complete

-reset

Execute T1218 System Binary Proxy Execution

null

-create

-addfile

-setnotifycmdline

-resume

-reset

Each abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for bitsadmin.exe.

4 documented commands

from LOLBAS, each read by the identifier

ADS T1564.004 Hide Artifacts: NTFS File Attributes User privileges

Create a bitsadmin job named 1, add cmd.exe to the job, configure the job to run the target command from an Alternate data stream, then resume and complete the job.

bitsadmin /create 1 bitsadmin /addfile 1 c:\windows\system32\cmd.exe c:\data\playfolder\cmd.exe bitsadmin /SetNotifyCmdLine 1 c:\data\playfolder\1.txt:cmd.exe NULL bitsadmin /RESUME 1 bitsadmin /complete 1

Identify

Trips 3 Sigma rules: highFile Download Via Bitsadmin To A Suspicious Target Folder by Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems); highFile With Suspicious Extension Downloaded Via Bitsadmin by Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems); mediumMonitoring For Persistence Via BITS by Sreeman

Download T1105 Ingress Tool Transfer User privileges

Create a bitsadmin job named 1, add cmd.exe to the job, configure the job to run the target command, then resume and complete the job.

bitsadmin /create 1 bitsadmin /addfile 1 https://live.sysinternals.com/autoruns.exe c:\data\playfolder\autoruns.exe bitsadmin /RESUME 1 bitsadmin /complete 1

Identify

Trips 2 Sigma rules: mediumFile Download Via Bitsadmin by Michael Haag, FPT.EagleEye; mediumMonitoring For Persistence Via BITS by Sreeman

Copy T1105 Ingress Tool Transfer User privileges

Command for copying cmd.exe to another folder

bitsadmin /create 1 & bitsadmin /addfile 1 c:\windows\system32\cmd.exe c:\data\playfolder\cmd.exe & bitsadmin /RESUME 1 & bitsadmin /Complete 1 & bitsadmin /reset

Identify

Trips 1 Sigma rule: highFile Download Via Bitsadmin To A Suspicious Target Folder by Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)

Execute T1218 System Binary Proxy Execution User privileges

One-liner that creates a bitsadmin job named 1, add cmd.exe to the job, configure the job to run the target command, then resume and complete the job.

bitsadmin /create 1 & bitsadmin /addfile 1 c:\windows\system32\cmd.exe c:\data\playfolder\cmd.exe & bitsadmin /SetNotifyCmdLine 1 c:\data\playfolder\cmd.exe NULL & bitsadmin /RESUME 1 & bitsadmin /Reset

Identify

Trips 2 Sigma rules: highFile Download Via Bitsadmin To A Suspicious Target Folder by Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems); mediumMonitoring For Persistence Via BITS by Sreeman

All 4 commands the identifier reads trip a Sigma process-creation rule. These commands and their descriptions are from LOLBAS’s entry for bitsadmin.exe, by Oddvar Moe, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for bitsadmin.exe. The identifier reads each with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.

What detects it

Sigma process creation rules

highSuspicious Download From Direct IP Via BitsadminFlorian Roth (Nextron Systems)

highSuspicious Download From File-Sharing Website Via BitsadminFlorian Roth (Nextron Systems)

highFile With Suspicious Extension Downloaded Via BitsadminFlorian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)

highFile Download Via Bitsadmin To A Suspicious Target FolderFlorian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)

mediumFile Download Via BitsadminMichael Haag, FPT.EagleEye

highExploited CVE-2020-10189 Zoho ManageEngineFlorian Roth (Nextron Systems)

highPotential Exploitation of CrushFTP RCE Vulnerability (CVE-2025-54309)Nisarg Suthar

highWindows Suspicious Child Process from Node.js - React2ShellSwachchhanda Shrawan Poudel (Nextron Systems), Nasreddine Bencherchali

highSuspicious BitLocker Access Agent Update Utility Executionandrewdanis, Swachchhanda Shrawan Poudel (Nextron Systems)

highSuspicious Shells Spawn by Java Utility KeytoolAndreas Hunkeler (@Karneades)

highSuspicious Child Process Of Manage Engine ServiceDeskFlorian Roth (Nextron Systems)

highSuspicious Processes Spawned by Java.EXEAndreas Hunkeler (@Karneades), Florian Roth

highSuspicious MSHTA Child ProcessMichael Haag

highSuspicious Child Process Of SQL ServerFPT.EagleEye Team, wagga

highSuspicious Microsoft OneNote Child ProcessTim Rauch (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Elastic (idea)

highSuspicious Microsoft Office Child ProcessFlorian Roth (Nextron Systems), Markus Neis, FPT.EagleEye Team, Vadim Khrykov, Cyb3rEng, Michael Haag, Christopher Peacock @securepeacock, @scythe_io

highSuspicious ShellExec_RunDLL Call Via OrdinalSwachchhanda Shrawan Poudel

highSuspicious Spool Service Child ProcessJustin C. (@endisphotic), @dreadphones (detection), Thomas Patzke (Sigma rule)

highPotentially Suspicious Execution From Parent Process In Public FolderFlorian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)

highWindows Shell/Scripting Processes Spawning Suspicious ProgramsFlorian Roth (Nextron Systems), Tim Shelton

highSystem File Execution Location AnomalyFlorian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali (Nextron Systems)

highSuspicious Process By Web Server ProcessThomas Patzke, Florian Roth (Nextron Systems), Zach Stanford @svch0st, Tim Shelton, Nasreddine Bencherchali (Nextron Systems)

highSuspicious Processes Spawned by WinRMAndreas Hunkeler (@Karneades), Markus Neis

mediumSuspicious Child Process of SAP NetWeaverElastic (idea), Swachchhanda Shrawan Poudel (Nextron Systems)

mediumPotentially Suspicious PowerShell Child ProcessesFlorian Roth (Nextron Systems), Tim Shelton

mediumMonitoring For Persistence Via BITSSreeman

mediumRemote Access Tool - ScreenConnect Potential Suspicious Remote Command ExecutionFlorian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), @Kostastsale

T1036.003Masquerading: Rename Legitimate Utilities

T1105Ingress Tool Transfer

T1197BITS Jobs

T1218System Binary Proxy Execution

T1564.004Hide Artifacts: NTFS File Attributes

Is it the real bitsadmin.exe?

file version info and known copies

Installed inC:\Windows\system32\
C:\Windows\SysWOW64\

Signed byMicrosoft Windows

ProductMicrosoft Windows Operating System, Microsoft Corporation

DescriptionBITS administration utility

12 known copies

7.8.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\bitsadmin.exe · signed by Microsoft Windows

8db6ff73aeebf4a2b3e15970e8a0697756b9d0ea0662ab15f7a8a26247a0b52f

7.8.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\bitsadmin.exe · signed by Microsoft Windows

be099ee67b12603684cfc4f47a0eac238f1e99e9fd780c6f6cfc3b9309e9a225

7.8.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\bitsadmin.exe · signed by Microsoft Windows

739b2dd012ea183895cc01116906f339c9aa1c0baabf6f22c8e59e25a0c12917

7.8.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\bitsadmin.exe · signed by Microsoft Windows

c93b7734470cf96c5170f7b21f361cdf3f74ca819626c83c4b8a68210deeb35c

7.8.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\bitsadmin.exe · signed by Microsoft Windows

c5adc38e0ce99a16cbbfcc10f16aa3a340ca0dcff836607d6f6152322013a129

7.8.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\bitsadmin.exe · signed by Microsoft Windows

eaae8536d554d0e86d8540a8b34db2649bd884843f389495d0b6e91636c6cf54

7.8.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\bitsadmin.exe · signed by Microsoft Windows

03c7e317e277bbd6c9c1159f8718a9d302e6f78e0d80c09d52a994b7598c0f30

7.8.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\bitsadmin.exe · signed by Microsoft Windows

4adc7b6e2e43726eff05bb3ff3df554f8427ab093ef3efed6a425769bd52f158

7.8.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\bitsadmin.exe · signed by Microsoft Windows

e1057a20945bce8f00c0be5e3db40c4a98ab33f42f4d2df919aedb0ef6651d6e

7.8.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\bitsadmin.exe · signed by Microsoft Windows

ecbc94e6dc79346702cbb0b5721e800ac5388a2fbfb586098bf6eadf5e062193

7.7.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\bitsadmin.exe · not signed

8f3f9e882e4db13860ae240d6f988d39b641b2ae50f21462ba320993445eebb8

7.7.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\bitsadmin.exe · not signed

e5892202db9c37f741ba345d2baae658893e10f11ff67dd481db6693fa3861d3

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

bitsadmin.exe

How bitsadmin.exe is abused

4 documented commands

What detects it

Is it the real bitsadmin.exe?

12 known copies

Other programs abused for ADS