BITSAdmin Download File

The analytic detects the use of `bitsadmin.exe` with the `transfer` or `addfile` parameters to download a remote object. This activity is significant because `bitsadmin.exe` can be exploited to download and execute malicious files without immediate detection. If confirmed malicious, an attacker could use this technique to download and execute payloads, potentially leading to code execution, privilege escalation, or persistent access within the environment. The rule leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and command-line telemetry. Review parallel and child processes, especially `svchost.exe`, for associated artifacts.