Artifact Analysis: BITS (Background Intelligent Transfer Service)

Danger

Executive Summary: The Background Intelligent Transfer Service (BITS) is a native Windows component designed to facilitate asynchronous, resilient file transfers between machines using idle network bandwidth. For threat actors, BITS is the ultimate “Living off the Land” (LOLBAS) utility. It allows them to download payloads, exfiltrate data, and establish persistence while seamlessly blending into legitimate, trusted system traffic generated by svchost.exe. For DFIR analysts, parsing the BITS ESE database and event logs is mandatory to reconstruct payload staging and C2 activity.

1. The Adversarial Appeal of BITS

To understand why BITS is a staple in modern cyberattacks (from ransomware affiliates to APTs), analysts must look at its architectural advantages:

1. Trusted Execution (Firewall Evasion): BITS transfers are executed by a legitimate Windows service hosted within svchost.exe -k netsvcs. Host-based firewalls and EDRs rarely block outbound HTTP/HTTPS traffic originating from this core OS process, making it an ideal proxy for fetching malicious payloads.
2. Extreme Resilience: BITS is designed to handle network interruptions. If a machine reboots or loses connection, the BITS job is paused and will automatically resume once connectivity is restored. This provides built-in persistence for the download/upload process.
3. Stealth (Idle Bandwidth): BITS prioritizes user experience by only utilizing “idle” bandwidth. This prevents massive network spikes that would typically alert network monitoring tools (NDR) during data exfiltration.
4. Command Execution (Persistence): BITS supports a feature called SetNotifyCmdLine. An attacker can configure a BITS job to execute a specific command or script immediately after a transfer finishes or fails, transforming a simple download manager into a highly reliable persistence mechanism.

2. Artifact Location & Structure

BITS activity is primarily tracked in two locations: an internal database and dedicated Windows Event Logs.

A. The BITS Database (qmgr.db)

The core forensic artifact is the active queue manager database.

• Path: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db (Older systems may use qmgr0.dat and qmgr1.dat).
• Format: Extensible Storage Engine (ESE) database.
• Forensic Value: This database retains a historical record of BITS jobs. Extracting and parsing this file reveals:
  • The Job Name and Description.
  • The Source URL (the external C2 or staging server).
  • The Destination Path (where the payload was dropped on disk).
  • Timestamps (Creation, Modification, Completion).
  • Notification Command Line (Any payload executed upon job completion).
  • The User SID of the account that requested the job.

B. Windows Event Logs

BITS maintains an operational log that tracks the lifecycle of every transfer.

• Log Path: Applications and Services Logs > Microsoft > Windows > Bits-Client > Operational
• Key Event IDs:
  • Event ID 59: BITS started a transfer job. (Contains the URL and destination file).
  • Event ID 60: BITS stopped transferring data. (Indicates completion or failure).
  • Event ID 16411: (On modern Windows 10/11) Provides rich context, including the name of the process that initiated the job request.

3. DFIR Investigation Strategy

When investigating a suspected compromise, BITS analysis provides the critical link between network activity and file execution.

1. Acquire & Parse the Database: Because qmgr.db is an active ESE database, it is locked by the OS. Analysts must use a raw disk reader or Volume Shadow Copy (VSS) to acquire it. Once acquired, use a specialized tool like BitsParser or KAPE to convert the ESE tables into a human-readable CSV.
2. Analyze Artifacts: Review the parsed database for anomalous destination extensions. A BITS job that downloads a .dat or .txt file but saves it to disk as C:\Users\Public\update.exe is a definitive indicator of compromise.
3. Cross-Artifact Correlation:
   • Network Pivot: Take the extracted Source URLs and query your proxy/firewall logs to identify other infected hosts.
   • Execution Pivot: Take the Destination Path and query Prefetch (.pf) and Amcache to prove whether the dropped payload was subsequently executed.

4. Detection & Threat Hunting

While parsing the database is a post-mortem activity, SOC analysts can proactively hunt for BITS abuse by monitoring process execution telemetry. Adversaries typically interact with BITS using the bitsadmin.exe legacy tool or the modern Start-BitsTransfer PowerShell cmdlet.

KQL (Defender XDR)

hunt_bits_lolbas_abuse.kql

// Detects suspicious usage of bitsadmin.exe and PowerShell BITS cmdlets
DeviceProcessEvents
| where ProcessCommandLine has_any ("bitsadmin", "Start-BitsTransfer")
// Look for common malicious flags (Transfer, Download, AddFile, SetNotifyCmdLine)
| where ProcessCommandLine has_any ("/transfer", "/create", "/addfile", "/SetNotifyCmdLine")
// Filter out expected administrative scripts if necessary
| where InitiatingProcessFileName !in~ ("sccm.exe", "msiexec.exe")
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, FileName, ProcessCommandLine
| sort by TimeGenerated desc

Sigma (Sysmon EID 1)

sigma_bitsadmin_download.yaml

title: Suspicious Download via BITSAdmin
id: 1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: stable
description: Detects the usage of bitsadmin.exe to download files, a common LOLBAS technique for payload staging.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\bitsadmin.exe'
        CommandLine|contains|all:
            - '/transfer'
            - 'http'
    # Optional: Add condition to detect SetNotifyCmdLine for persistence
    selection_persist:
        Image|endswith: '\bitsadmin.exe'
        CommandLine|contains: '/SetNotifyCmdLine'
    condition: selection or selection_persist
level: high
tags:
    - attack.defense_evasion
    - attack.t1197

---

References & Further Reading

• LOLBAS Project: BITSAdmin.exe
• FireEye / Mandiant: Tracking Malware with BITS
• Related Artifact: Event ID 4688 (Process Creation)
• Related Artifact: Amcache & RecentFileCache