Get in touch
← Sentinel Explorer
↳ GitHub sourceAnalytics ruleMedium

Bitsadmin Activity

View on GitHub ↗Original file ↗

Description

Background Intelligent Transfer Service (BITS) is a way to reliably download files from webservers or SMB servers. This service is commonly used for legitimate purposes, but can also be used as part of a malware downloader. Additionally, bitsadmin can be used to upload files and therefore can be used for data exfiltration. This query will identify use of bitsadmin.exe for either purpose and will identify directionality file transfer directionality.
Rule type
Scheduled
Version
1.0.0
Declared status
Available
Query frequency
1h
Query period
1h
Trigger
gt 0

Declared MITRE coverage

PersistenceCommandAndControlExfiltrationT1197T1105T1048

Declared sources

Metadata from the source file. No dependencies inferred from KQL.

Connectors

MicrosoftThreatProtection

Data types

DeviceProcessEvents

KQL query

Original query, unchanged.

DeviceProcessEvents
| where 
    (FileName =~ "bitsadmin.exe" or column_ifexists('ProcessVersionInfoOriginalFileName','ColumnNotAvailable') =~ 'bitsadmin.exe')
    and ProcessCommandLine has_any ('/Transfer','/AddFile', '/AddFileSet','/AddFileWithRanges')
| extend 
    ParsedCommandLine = parse_command_line(ProcessCommandLine,'windows')
| extend     
    RemoteUrl = tostring(ParsedCommandLine[-2]),
    LocalFile= tostring(ParsedCommandLine[-1]),
    Direction = iff(ProcessCommandLine has "/Upload", 'Upload', 'Download')
| project-reorder 
    TimeGenerated,
    DeviceId,
    DeviceName,
    Direction,
    RemoteUrl,
    LocalFile,
    InitiatingProcessFolderPath,
    InitiatingProcessAccountDomain,
    InitiatingProcessAccountName,
    InitiatingProcessSHA256,
    ProcessId,
    ProcessCommandLine
| extend HostName = iff(DeviceName has '.', substring(DeviceName, 0, indexof(DeviceName, '.')), DeviceName)
| extend DnsDomain = iff(DeviceName has '.', substring(DeviceName, indexof(DeviceName, '.') + 1), "")

Declared entities

HostProcess

Related content

Links established from declared identifiers and solution manifests.

Solutions1
Connectors1

Source provenance

GitHub

Displayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.

Source identifier
2a1dc4c2-a8d6-4a0e-8539-9b971c851195
Additional source files 2Solutions/Microsoft Defender XDR/Analytic Rules/Execution/BITSAdminActivity.yamlsource ↗Solutions/Microsoft Defender XDR/Data/Solution_Microsoft Defender XDR.jsonsolution-membership ↗
GSTEP / CATALOG TRACKING

Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC

GSTEP sync dates, separate from the source content’s publication dates.