BITS Abuse via bitsadmin/Start-BitsTransfer to Suspicious Paths (untrusted host)

Kanan Hatamov@hatamovkanan

•updated today•1•0•17

Detects the abuse of Windows Background Intelligent Transfer Service (BITS) using either bitsadmin.exe or PowerShell's Start-BitsTransfer cmdlet to download files to suspicious directories such as AppData, Temp, or ProgramData, excluding common trusted domains.