BITSAdmin Persistence via SetNotifyCmdLine or Remote File Download

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•14

This rule detects the use of `bitsadmin.exe` to create or modify BITS jobs that can be used for persistence. Specifically, it looks for command-line arguments that either set a notification command (`/SetNotifyCmdLine`) to execute a program (like `cmd.exe` or `regsvr32.exe`) or add a file for download (`/Addfile`) from a remote HTTP/HTTPS/FTP source. Adversaries can abuse BITS jobs to schedule the download and execution of malicious binaries, establishing a backdoor and maintaining persistence on a system.