LOLBAS. GitHub
LIVING OFF THE LAND / OS BINARIES

Bitsadmin.exe

View source

Used for managing background intelligent transfer

ADSDownloadCopyExecute
04COMMAND EXAMPLES
03ATT&CK TECHNIQUES
04DETECTION RESOURCES
04CAPABILITIES
01 / TRADECRAFT

Command reference

4 examples

ADS1

EXAMPLE 01T1564.004

Create a bitsadmin job named 1, add cmd.exe to the job, configure the job to run the target command from an Alternate data stream, then resume and complete the job.

COMMAND
bitsadmin /create 1 bitsadmin /addfile 1 c:\windows\system32\cmd.exe c:\data\playfolder\cmd.exe bitsadmin /SetNotifyCmdLine 1 c:\data\playfolder\1.txt:cmd.exe NULL bitsadmin /RESUME 1 bitsadmin /complete 1
USE CASE
Performs execution of specified file in the alternate data stream, can be used as a defensive evasion or persistence technique.
PRIVILEGES
User
OPERATING SYSTEM
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11

Download1

EXAMPLE 01T1105

Create a bitsadmin job named 1, add cmd.exe to the job, configure the job to run the target command, then resume and complete the job.

COMMAND
bitsadmin /create 1 bitsadmin /addfile 1 https://live.sysinternals.com/autoruns.exe c:\data\playfolder\autoruns.exe bitsadmin /RESUME 1 bitsadmin /complete 1
USE CASE
Download file from Internet
PRIVILEGES
User
OPERATING SYSTEM
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11

Copy1

EXAMPLE 01T1105

Command for copying cmd.exe to another folder

COMMAND
bitsadmin /create 1 & bitsadmin /addfile 1 c:\windows\system32\cmd.exe c:\data\playfolder\cmd.exe & bitsadmin /RESUME 1 & bitsadmin /Complete 1 & bitsadmin /reset
USE CASE
Copy file
PRIVILEGES
User
OPERATING SYSTEM
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10

Execute1

EXAMPLE 01T1218

One-liner that creates a bitsadmin job named 1, add cmd.exe to the job, configure the job to run the target command, then resume and complete the job.

COMMAND
bitsadmin /create 1 & bitsadmin /addfile 1 c:\windows\system32\cmd.exe c:\data\playfolder\cmd.exe & bitsadmin /SetNotifyCmdLine 1 c:\data\playfolder\cmd.exe NULL & bitsadmin /RESUME 1 & bitsadmin /Reset
USE CASE
Execute binary file specified. Can be used as a defensive evasion.
PRIVILEGES
User
OPERATING SYSTEM
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
02 / ON DISK

Known paths

C:\Windows\System32\bitsadmin.exe
C:\Windows\SysWOW64\bitsadmin.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

4 resources

Indicators & detection notes

  • IOC

    Child process from bitsadmin.exe

  • IOC

    bitsadmin creates new files

  • IOC

    bitsadmin adds data to alternate data stream

FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Rob Fuller@mubix
Chris Gates@carnal0wnage
Oddvar Moe@oddvarmoe