.NET Loader - BITSAdmin Job Transfer with DLL Renaming (T1197)

Ibrahim Saud@tektrix

•updated Jun 20, 2026•0•0•5

Parses BITSAdmin command lines to detect the stealthy download of the secondary loader, specifically looking for arbitrary extensions being renamed to .dll upon completion.