{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1197","id":"T1197","name":"BITS Jobs","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1197","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"263610671c06be7b0820cd0076e3584d52ea470bf56e6f9a3595c69e15edf285","description":"Adversaries may abuse BITS jobs to persistently execute code and perform various background tasks. Windows Background Intelligent Transfer Service (BITS) is a low-bandwidth, asynchronous file transfer mechanism exposed through [Component Object Model](https://attack.mitre.org/techniques/T1559/001) (COM).(Citation: Microsoft COM)(Citation: Microsoft BITS) BITS is commonly used by updaters, messengers, and other applications preferred to operate in the background (using available idle bandwidth) without interrupting other networked applications. File transfer tasks are implemented as BITS jobs, which contain a queue of one or more file operations.\n\nThe interface to create and manage BITS jobs is accessible through [PowerShell](https://attack.mitre.org/techniques/T1059/001) and the [BITSAdmin](https://attack.mitre.org/software/S0190) tool.(Citation: Microsoft BITS)(Citation: Microsoft BITSAdmin)\n\nAdversaries may abuse BITS to download (e.g. [Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105)), execute, and even clean up after running malicious code (e.g. [Indicator Removal](https://attack.mitre.org/techniques/T1070)). BITS tasks are self-contained in the BITS job database, without new files or registry modifications, and often permitted by host firewalls.(Citation: CTU BITS Malware June 2016)(Citation: Mondok Windows PiggyBack BITS May 2007)(Citation: Symantec BITS May 2007) BITS enabled execution may also enable persistence by creating long-standing jobs (the default maximum lifetime is 90 days and extendable) or invoking an arbitrary program when a job completes or errors (including after system reboots).(Citation: PaloAlto UBoatRAT Nov 2017)(Citation: CTU BITS Malware June 2016)\n\nBITS upload functionalities can also be used to perform [Exfiltration Over Alternative Protocol](https://attack.mitre.org/techniques/T1048).(Citation: CTU BITS Malware June 2016)","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1197","external_id":"T1197"},{"source_name":"CTU BITS Malware June 2016","description":"Counter Threat Unit Research Team. (2016, June 6). Malware Lingers with BITS. Retrieved January 12, 2018.","url":"https://www.secureworks.com/blog/malware-lingers-with-bits"},{"source_name":"Symantec BITS May 2007","description":"Florio, E. (2007, May 9). Malware Update with Windows Update. Retrieved January 12, 2018.","url":"https://www.symantec.com/connect/blogs/malware-update-windows-update"},{"source_name":"PaloAlto UBoatRAT Nov 2017","description":"Hayashi, K. (2017, November 28). UBoatRAT Navigates East Asia. Retrieved January 12, 2018.","url":"https://researchcenter.paloaltonetworks.com/2017/11/unit42-uboatrat-navigates-east-asia/"},{"source_name":"Microsoft BITS","description":"Microsoft. (n.d.). Background Intelligent Transfer Service. Retrieved January 12, 2018.","url":"https://msdn.microsoft.com/library/windows/desktop/bb968799.aspx"},{"source_name":"Microsoft BITSAdmin","description":"Microsoft. (n.d.). BITSAdmin Tool. Retrieved January 12, 2018.","url":"https://msdn.microsoft.com/library/aa362813.aspx"},{"source_name":"Microsoft COM","description":"Microsoft. (n.d.). Component Object Model (COM). Retrieved November 22, 2017.","url":"https://msdn.microsoft.com/library/windows/desktop/ms680573.aspx"},{"source_name":"Mondok Windows PiggyBack BITS May 2007","description":"Mondok, M. (2007, May 11). Malware piggybacks on Windows’ Background Intelligent Transfer Service. Retrieved January 12, 2018.","url":"https://arstechnica.com/information-technology/2007/05/malware-piggybacks-on-windows-background-intelligent-transfer-service/"}],"platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[],"telemetry":[{"id":"DC0064","name":"Command Execution","page":"telemetry/DC0064/","kind":"attack_component","category":"Script and command execution","description":"Execution of a command and its interpreter or parent context.","collection_focus":"Collect process command lines and relevant shell/interpreter audit; shell history alone is neither complete nor tamper-resistant.","providers":[{"name":"PowerShell Script Block Logging","scope":"Script content via event 4104 when configured; channel depends on PowerShell edition.","source_id":"powershell"},{"name":"Sysmon process events","scope":"Interpreter launch and parent context, not full script content.","source_id":"sysmon"},{"name":"Linux Audit","scope":"execve-family execution context; shell built-ins need additional instrumentation.","source_id":"linux"}],"configuration":["Enable Script Block Logging through the policy/configuration for the installed edition. Forward Microsoft-Windows-PowerShell/Operational for Windows PowerShell, or PowerShellCore/Operational for PowerShell 7.","Retain script-block ID and fragment ordering alongside process creation. Protect access to collected script text; secrets may be included.","On Linux, use narrowly scoped Audit execution rules for the lab account and supported architectures, and retain joined SYSCALL/EXECVE/PATH records."],"configuration_example":null,"required_fields":["interpreter","command_line","actor_uid","session_id"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0064","collector":"illustrative-lab-collector","observation":{"interpreter":"/bin/sh","command_line":"printf LAB_TELEMETRY_CHECK","actor_uid":1000,"session_id":"lab-session-1"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Script content and process command lines are different signals. Logging may be partial, fragmented, filtered or disabled; never assume a command line reveals everything executed.","sources":[{"id":"powershell","title":"Microsoft PowerShell logging on Windows","url":"https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_logging_windows?view=powershell-7.5"},{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"}],"association":"attack_component","anomaly_design":"Per host role and principal: rare interpreters, command argument patterns and parent-child sequences. Normalize scripts carefully; obfuscation, administrative automation and missing command lines change visibility."},{"id":"DC0082","name":"Network Connection Creation","page":"telemetry/DC0082/","kind":"attack_component","category":"Endpoint activity","description":"Creation of an endpoint network connection linked to a process.","collection_focus":"Enable scoped Sysmon NetworkConnect (3), disabled by default, or a platform-equivalent process-aware network sensor.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["process_guid","destination_ip","destination_port","protocol","initiated"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0082","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","initiated":true}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0032","name":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component","category":"Endpoint activity","description":"Creation of a process with executable, command line, parent and security context.","collection_focus":"Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":{"label":"Sysmon filter fragment · merge into the reviewed lab configuration","language":"xml","source_id":"sysmon_config","content":"<EventFiltering>\n  <ProcessCreate onmatch=\"include\">\n    <Image condition=\"is\">C:\\Windows\\System32\\whoami.exe</Image>\n  </ProcessCreate>\n</EventFiltering>","note":"This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>."},"required_fields":["process_guid","image","parent_image","command_line","user"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0060","name":"Service Creation","page":"telemetry/DC0060/","kind":"attack_component","category":"Windows and directory audit","description":"Installation or registration of a service.","collection_focus":"Collect service-install auditing through Audit Security System Extension where supported, plus Service Control Manager/System logs and the new service configuration.","providers":[{"name":"Windows Security auditing","scope":"Policy-dependent account, object, task and logon records on the host that performs the operation.","source_id":"audit"}],"configuration":["Use a lab-only GPO under Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration. Enable the specific subcategory named below.","For object-level auditing, configure a narrow system access control list (SACL) on the test object in addition to policy. Do not audit an entire production directory by default.","Forward Security events from the responsible host or controller; retain subject and target identities, object identifiers, result and original XML. Confirm effective policy with auditpol /get /category:*."],"configuration_example":null,"required_fields":["service","action","executable","actor"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0060","collector":"illustrative-lab-collector","observation":{"service":"LabService","action":"install","executable":"C:\\Lab\\service.exe","actor":"lab-admin"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"A policy checkbox alone does not guarantee an event. Host role, SACL, success/failure selection and audit policy precedence matter. Directory changes may arrive as multiple records.","sources":[{"id":"audit","title":"Microsoft advanced security audit policy","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-audit-policy-settings"},{"id":"ad","title":"Microsoft Audit Directory Service Changes","url":"https://learn.microsoft.com/windows/security/threat-protection/auditing/audit-directory-service-changes"},{"id":"task","title":"Microsoft scheduled-task creation event 4698","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4698"}],"association":"attack_component","anomaly_design":"Per principal, host and object: unusual access/request rates, new principal-object relationships, and changes outside approved administration windows. Control for service accounts and scheduled directory maintenance."}],"detection":{"key":"enterprise/T1197","id":"T1197","name":"BITS Jobs","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"source_url":"https://attack.mitre.org/techniques/T1197","technique_page":"techniques/enterprise/T1197/","page":"detections/enterprise/T1197/","status":"rule_source_available","counts":{"sigma":15,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"sigma_rules":[{"id":"8ccd35a2-1c7c-468b-b568-ac6cdf80eec3","title":"Bitsadmin to Uncommon IP Server Address","status":"test","level":"high","logsource":{"category":"proxy"},"data_path":"data/detection-rules/8ccd35a2-1c7c-468b-b568-ac6cdf80eec3.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/web/proxy_generic/proxy_ua_bitsadmin_susp_ip.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"9eb68894-7476-4cd6-8752-23b51f5883a7","title":"Bitsadmin to Uncommon TLD","status":"test","level":"high","logsource":{"category":"proxy"},"data_path":"data/detection-rules/9eb68894-7476-4cd6-8752-23b51f5883a7.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/web/proxy_generic/proxy_ua_bitsadmin_susp_tld.yml","author":"Florian Roth (Nextron Systems), Tim Shelton","kind":"sigma"},{"id":"1ff315dc-2a3a-4b71-8dde-873818d25d39","title":"New BITS Job Created Via Bitsadmin","status":"test","level":"low","logsource":{"product":"windows","service":"bits-client"},"data_path":"data/detection-rules/1ff315dc-2a3a-4b71-8dde-873818d25d39.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/bits_client/win_bits_client_new_job_via_bitsadmin.yml","author":"frack113","kind":"sigma"},{"id":"fe3a2d49-f255-4d10-935c-bda7391108eb","title":"New BITS Job Created Via PowerShell","status":"test","level":"low","logsource":{"product":"windows","service":"bits-client"},"data_path":"data/detection-rules/fe3a2d49-f255-4d10-935c-bda7391108eb.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/bits_client/win_bits_client_new_job_via_powershell.yml","author":"frack113","kind":"sigma"},{"id":"b85e5894-9b19-4d86-8c87-a2f3b81f0521","title":"BITS Transfer Job Downloading File Potential Suspicious Extension","status":"test","level":"medium","logsource":{"product":"windows","service":"bits-client"},"data_path":"data/detection-rules/b85e5894-9b19-4d86-8c87-a2f3b81f0521.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/bits_client/win_bits_client_new_transfer_saving_susp_extensions.yml","author":"frack113","kind":"sigma"},{"id":"d635249d-86b5-4dad-a8c7-d7272b788586","title":"BITS Transfer Job Download From File Sharing Domains","status":"test","level":"high","logsource":{"product":"windows","service":"bits-client"},"data_path":"data/detection-rules/d635249d-86b5-4dad-a8c7-d7272b788586.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/bits_client/win_bits_client_new_transfer_via_file_sharing_domains.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"90f138c1-f578-4ac3-8c49-eecfd847c8b7","title":"BITS Transfer Job Download From Direct IP","status":"test","level":"high","logsource":{"product":"windows","service":"bits-client"},"data_path":"data/detection-rules/90f138c1-f578-4ac3-8c49-eecfd847c8b7.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/bits_client/win_bits_client_new_transfer_via_ip_address.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"6d44fb93-e7d2-475c-9d3d-54c9c1e33427","title":"BITS Transfer Job With Uncommon Or Suspicious Remote TLD","status":"test","level":"medium","logsource":{"product":"windows","service":"bits-client"},"data_path":"data/detection-rules/6d44fb93-e7d2-475c-9d3d-54c9c1e33427.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/bits_client/win_bits_client_new_transfer_via_uncommon_tld.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"f8a56cb7-a363-44ed-a82f-5926bb44cd05","title":"BITS Transfer Job Download To Potential Suspicious Folder","status":"test","level":"high","logsource":{"product":"windows","service":"bits-client"},"data_path":"data/detection-rules/f8a56cb7-a363-44ed-a82f-5926bb44cd05.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/bits_client/win_bits_client_new_trasnfer_susp_local_folder.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"d059842b-6b9d-4ed1-b5c3-5b89143c6ede","title":"File Download Via Bitsadmin","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/d059842b-6b9d-4ed1-b5c3-5b89143c6ede.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_bitsadmin_download.yml","author":"Michael Haag, FPT.EagleEye","kind":"sigma"},{"id":"99c840f2-2012-46fd-9141-c761987550ef","title":"Suspicious Download From Direct IP Via Bitsadmin","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/99c840f2-2012-46fd-9141-c761987550ef.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_bitsadmin_download_direct_ip.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"8518ed3d-f7c9-4601-a26c-f361a4256a0c","title":"Suspicious Download From File-Sharing Website Via Bitsadmin","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/8518ed3d-f7c9-4601-a26c-f361a4256a0c.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_bitsadmin_download_file_sharing_domains.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"5b80a791-ad9b-4b75-bcc1-ad4e1e89c200","title":"File With Suspicious Extension Downloaded Via Bitsadmin","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/5b80a791-ad9b-4b75-bcc1-ad4e1e89c200.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_bitsadmin_download_susp_extensions.yml","author":"Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"2ddef153-167b-4e89-86b6-757a9e65dcac","title":"File Download Via Bitsadmin To A Suspicious Target Folder","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/2ddef153-167b-4e89-86b6-757a9e65dcac.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_bitsadmin_download_susp_targetfolder.yml","author":"Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"b9cbbc17-d00d-4e3d-a827-b06d03d2380d","title":"Monitoring For Persistence Via BITS","status":"test","level":"medium","logsource":{"product":"windows","category":"process_creation"},"data_path":"data/detection-rules/b9cbbc17-d00d-4e3d-a827-b06d03d2380d.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_bitsadmin_potential_persistence.yml","author":"Sreeman","kind":"sigma"}],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0098","name":"Detect abuse of Windows BITS Jobs for download, execution and persistence","url":"https://attack.mitre.org/detectionstrategies/DET0098","stix_id":"x-mitre-detection-strategy--de9fde27-426b-4cb1-afcd-dbe1f7d4273f","relationship_id":"relationship--0967546e-b205-4de2-92eb-2847cb4ad94e","description":"","analytics":[{"id":"AN0274","name":"Analytic 0274","guidance":"Behavioral chain: (1) An actor creates or modifies a BITS job via bitsadmin.exe, PowerShell BITS cmdlets, or COM; (2) the job performs HTTP(S)/SMB network transfers while the owning user is logged on; (3) upon job completion/error, BITS launches a notify command (SetNotifyCmdLine) from svchost.exe -k netsvcs -s BITS, often establishing persistence by keeping long-lived jobs. The strategy correlates process creation, command/script telemetry, BITS-Client operational events, and network connections initiated by BITS.","url":"https://attack.mitre.org/detectionstrategies/DET0098#AN0274","platforms":["Windows"],"tuning":[{"field":"TimeWindow","description":"Correlation window linking job creation, transfer, and notify execution (e.g., 30m–24h depending on environment and BITS retry behavior)."},{"field":"ExpectedUpdateHosts","description":"Allow-list of corporate update/CDN endpoints that legitimately use BITS (WSUS, MEMCM, vendor updaters)."},{"field":"SuspiciousCliSwitches","description":"BITSAdmin flags of interest (/transfer, /addfile, /SetNotifyCmdLine, /resume, /setcustomheaders, /setminretrydelay)."},{"field":"NotifyCmdBlockList","description":"Known risky binaries or folders (e.g., %TEMP%\\*.exe, powershell.exe, cmd.exe) used as BITS notify commands."},{"field":"UserContext","description":"Scope by interactive users, service accounts, or high-value targets (admins/servers) to reduce benign noise."},{"field":"ExternalNetCIDRs","description":"Definition of external/non-corp destinations for network correlation."},{"field":"JobLifetimeThreshold","description":"Maximum age or retry count for benign jobs before flagging persistence (e.g., >3 days or retry>20)."}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"WinEventLog:Security","channel":"EventCode=4688","platforms":["Windows"],"analytic_id":"AN0274","source_url":"https://attack.mitre.org/detectionstrategies/DET0098#AN0274","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0082","component":"Network Connection Creation","name":"WinEventLog:Sysmon","channel":"EventCode=3, 22","platforms":["Windows"],"analytic_id":"AN0274","source_url":"https://attack.mitre.org/detectionstrategies/DET0098#AN0274","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0082/"},{"component_id":"DC0064","component":"Command Execution","name":"WinEventLog:PowerShell","channel":"EventCode=4103, 4104, 4105, 4106","platforms":["Windows"],"analytic_id":"AN0274","source_url":"https://attack.mitre.org/detectionstrategies/DET0098#AN0274","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0064/"},{"component_id":"DC0060","component":"Service Creation","name":"WinEventLog:System","channel":"EventCode=7036","platforms":["Windows"],"analytic_id":"AN0274","source_url":"https://attack.mitre.org/detectionstrategies/DET0098#AN0274","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0060/"}]}]}],"telemetry_references":[{"id":"DC0064","name":"Command Execution","tag":"Command Execution","page":"telemetry/DC0064/","kind":"attack_component"},{"id":"DC0082","name":"Network Connection Creation","tag":"Network Connection Creation","page":"telemetry/DC0082/","kind":"attack_component"},{"id":"DC0032","name":"Process Creation","tag":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component"},{"id":"DC0060","name":"Service Creation","tag":"Service Creation","page":"telemetry/DC0060/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[{"id":"S0190","name":"BITSAdmin","page":"tools/S0190/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0154","name":"Cobalt Strike","page":"tools/S0154/","kind":"selected_framework","bases":["attack_uses"],"guides":[]}],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[{"id":"S0190","name":"BITSAdmin","page":"tools/S0190/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0154","name":"Cobalt Strike","page":"tools/S0154/","kind":"selected_framework","bases":["attack_uses"],"guides":[]}],"software":[{"id":"S0154","name":"Cobalt Strike","url":"https://attack.mitre.org/software/S0154","kind":"malware","description":"[Cobalt Strike](https://attack.mitre.org/software/S0154) can download a hosted \"beacon\" payload using [BITSAdmin](https://attack.mitre.org/software/S0190).(Citation: CobaltStrike Scripted Web Delivery)(Citation: Talos Cobalt Strike September 2020)(Citation: Cobalt Strike Manual 4.3 November 2020)","relationship_id":"relationship--2d0748e3-7427-4847-9861-75680f6aacb3","references":[{"source_name":"Talos Cobalt Strike September 2020","description":"Mavis, N. (2020, September 21). The Art and Science of Detecting Cobalt Strike. Retrieved September 12, 2024.","url":"https://web.archive.org/web/20210219195905/https://talos-intelligence-site.s3.amazonaws.com/production/document_files/files/000/095/031/original/Talos_Cobalt_Strike.pdf"},{"source_name":"Cobalt Strike Manual 4.3 November 2020","description":"Strategic Cyber LLC. (2020, November 5). Cobalt Strike: Advanced Threat Tactics for Penetration Testers. Retrieved April 13, 2021.","url":"https://web.archive.org/web/20210708035426/https://www.cobaltstrike.com/downloads/csmanual43.pdf"},{"source_name":"CobaltStrike Scripted Web Delivery","description":"Strategic Cyber, LLC. (n.d.). Scripted Web Delivery. Retrieved January 23, 2018.","url":"https://www.cobaltstrike.com/help-scripted-web-delivery"}]},{"id":"S0190","name":"BITSAdmin","url":"https://attack.mitre.org/software/S0190","kind":"tool","description":"[BITSAdmin](https://attack.mitre.org/software/S0190) can be used to create [BITS Jobs](https://attack.mitre.org/techniques/T1197) to launch a malicious process.(Citation: TrendMicro Tropic Trooper Mar 2018)","relationship_id":"relationship--cdf7492f-4cdd-4119-aa5e-0d94a07a3965","references":[{"source_name":"TrendMicro Tropic Trooper Mar 2018","description":"Horejsi, J., et al. (2018, March 14). Tropic Trooper’s New Strategy. Retrieved November 9, 2018.","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/tropic-trooper-new-strategy/"}]},{"id":"S0201","name":"JPIN","url":"https://attack.mitre.org/software/S0201","kind":"malware","description":"A [JPIN](https://attack.mitre.org/software/S0201) variant downloads the backdoor payload via the BITS service.(Citation: Microsoft PLATINUM April 2016)","relationship_id":"relationship--45d8c4f2-27e4-4063-9eec-d8023c61c74b","references":[{"source_name":"Microsoft PLATINUM April 2016","description":"Windows Defender Advanced Threat Hunting Team. (2016, April 29). PLATINUM: Targeted attacks in South and Southeast Asia. Retrieved February 15, 2018.","url":"https://download.microsoft.com/download/2/2/5/225BFE3E-E1DE-4F5B-A77B-71200928D209/Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf"}]},{"id":"S0333","name":"UBoatRAT","url":"https://attack.mitre.org/software/S0333","kind":"malware","description":"[UBoatRAT](https://attack.mitre.org/software/S0333) takes advantage of the /SetNotifyCmdLine option in [BITSAdmin](https://attack.mitre.org/software/S0190) to ensure it stays running on a system to maintain persistence.(Citation: PaloAlto UBoatRAT Nov 2017)","relationship_id":"relationship--4f290a4e-983c-460f-b00c-e1bc8dd4d413","references":[{"source_name":"PaloAlto UBoatRAT Nov 2017","description":"Hayashi, K. (2017, November 28). UBoatRAT Navigates East Asia. Retrieved January 12, 2018.","url":"https://researchcenter.paloaltonetworks.com/2017/11/unit42-uboatrat-navigates-east-asia/"}]},{"id":"S0534","name":"Bazar","url":"https://attack.mitre.org/software/S0534","kind":"malware","description":"[Bazar](https://attack.mitre.org/software/S0534) has been downloaded via Windows BITS functionality.(Citation: NCC Group Team9 June 2020)","relationship_id":"relationship--2296f1da-0910-46ee-81f7-5d10cb8753cd","references":[{"source_name":"NCC Group Team9 June 2020","description":"Pantazopoulos, N. (2020, June 2). In-depth analysis of the new Team9 malware family. Retrieved December 1, 2020.","url":"https://research.nccgroup.com/2020/06/02/in-depth-analysis-of-the-new-team9-malware-family/"}]},{"id":"S0554","name":"Egregor","url":"https://attack.mitre.org/software/S0554","kind":"malware","description":"[Egregor](https://attack.mitre.org/software/S0554) has used BITSadmin to download and execute malicious DLLs.(Citation: Intrinsec Egregor Nov 2020)","relationship_id":"relationship--35e66e21-edaf-46ed-8cec-32ba4ce92aa4","references":[{"source_name":"Intrinsec Egregor Nov 2020","description":"Bichet, J. (2020, November 12). Egregor – Prolock: Fraternal Twins ?. Retrieved January 6, 2021.","url":"https://www.intrinsec.com/egregor-prolock/?cn-reloaded=1"}]},{"id":"S0652","name":"MarkiRAT","url":"https://attack.mitre.org/software/S0652","kind":"malware","description":"[MarkiRAT](https://attack.mitre.org/software/S0652) can use BITS Utility to connect with the C2 server.(Citation: Kaspersky Ferocious Kitten Jun 2021)","relationship_id":"relationship--0ff081b9-5dde-4b48-a90f-3baf26b32a16","references":[{"source_name":"Kaspersky Ferocious Kitten Jun 2021","description":"GReAT. (2021, June 16). Ferocious Kitten: 6 Years of Covert Surveillance in Iran. Retrieved September 22, 2021.","url":"https://securelist.com/ferocious-kitten-6-years-of-covert-surveillance-in-iran/102806/"}]},{"id":"S0654","name":"ProLock","url":"https://attack.mitre.org/software/S0654","kind":"malware","description":"[ProLock](https://attack.mitre.org/software/S0654) can use BITS jobs to download its malicious payload.(Citation: Group IB Ransomware September 2020)","relationship_id":"relationship--94e040f2-c1e7-4159-839f-c4a2497232f3","references":[{"source_name":"Group IB Ransomware September 2020","description":"Group IB. (2020, September). LOCK LIKE  A PRO. Retrieved November 17, 2024.","url":"https://web.archive.org/web/20220119114433/https://groupib.pathfactory.com/ransomware-reports/prolock_wp"}]}],"actors":[{"id":"G0040","name":"Patchwork","url":"https://attack.mitre.org/groups/G0040","kind":"intrusion-set","description":"[Patchwork](https://attack.mitre.org/groups/G0040) has used BITS jobs to download malicious payloads.(Citation: Unit 42 BackConfig May 2020)","relationship_id":"relationship--19cc1620-de41-4076-b5b8-9d64364a578a","references":[{"source_name":"Unit 42 BackConfig May 2020","description":"Hinchliffe, A. and Falcone, R. (2020, May 11). Updated BackConfig Malware Targeting Government and Military Organizations in South Asia. Retrieved June 17, 2020.","url":"https://unit42.paloaltonetworks.com/updated-backconfig-malware-targeting-government-and-military-organizations/"}]},{"id":"G0065","name":"Leviathan","url":"https://attack.mitre.org/groups/G0065","kind":"intrusion-set","description":"[Leviathan](https://attack.mitre.org/groups/G0065) has used [BITSAdmin](https://attack.mitre.org/software/S0190) to download additional tools.(Citation: FireEye Periscope March 2018)","relationship_id":"relationship--b5894858-3f86-48f4-8ae0-7fcb8c19c36b","references":[{"source_name":"FireEye Periscope March 2018","description":"FireEye. (2018, March 16). Suspected Chinese Cyber Espionage Group (TEMP.Periscope) Targeting U.S. Engineering and Maritime Industries. Retrieved April 11, 2018.","url":"https://www.fireeye.com/blog/threat-research/2018/03/suspected-chinese-espionage-group-targeting-maritime-and-engineering-industries.html"}]},{"id":"G0087","name":"APT39","url":"https://attack.mitre.org/groups/G0087","kind":"intrusion-set","description":"[APT39](https://attack.mitre.org/groups/G0087) has used the BITS protocol to exfiltrate stolen data from a compromised host.(Citation: FBI FLASH APT39 September 2020)","relationship_id":"relationship--c6b51e0c-d6a8-4815-b1fe-fb065ac0bcaa","references":[{"source_name":"FBI FLASH APT39 September 2020","description":"FBI. (2020, September 17). Indicators of Compromise Associated with Rana Intelligence Computing, also known as Advanced Persistent Threat 39, Chafer, Cadelspy, Remexi, and ITG07. Retrieved December 10, 2020.","url":"https://www.iranwatch.org/sites/default/files/public-intelligence-alert.pdf"}]},{"id":"G0096","name":"APT41","url":"https://attack.mitre.org/groups/G0096","kind":"intrusion-set","description":"[APT41](https://attack.mitre.org/groups/G0096) used [BITSAdmin](https://attack.mitre.org/software/S0190) to download and install payloads.(Citation: FireEye APT41 March 2020)(Citation: Crowdstrike GTR2020 Mar 2020)","relationship_id":"relationship--d316289b-26fa-49d7-8ed0-3fa56cc858b7","references":[{"source_name":"FireEye APT41 March 2020","description":"Glyer, C, et al. (2020, March). This Is Not a Test: APT41 Initiates Global Intrusion Campaign Using Multiple Exploits. Retrieved April 28, 2020.","url":"https://www.fireeye.com/blog/threat-research/2020/03/apt41-initiates-global-intrusion-campaign-using-multiple-exploits.html"},{"source_name":"Crowdstrike GTR2020 Mar 2020","description":"Crowdstrike. (2020, March 2). 2020 Global Threat Report. Retrieved December 11, 2020.","url":"https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf"}]},{"id":"G0102","name":"Wizard Spider","url":"https://attack.mitre.org/groups/G0102","kind":"intrusion-set","description":"[Wizard Spider](https://attack.mitre.org/groups/G0102) has used batch scripts that utilizes WMIC to execute a [BITSAdmin](https://attack.mitre.org/software/S0190) transfer of a ransomware payload to each compromised machine.(Citation: Mandiant FIN12 Oct 2021) ","relationship_id":"relationship--fb229043-04d8-40e8-a155-bd2471bfc5c3","references":[{"source_name":"Mandiant FIN12 Oct 2021","description":"Shilko, J., et al. (2021, October 7). FIN12: The Prolific Ransomware Intrusion Threat Actor That Has Aggressively Pursued Healthcare Targets. Retrieved June 15, 2023.","url":"https://web.archive.org/web/20220313061955/https://www.mandiant.com/sites/default/files/2021-10/fin12-group-profile.pdf"}]}],"mitigations":[{"id":"M1018","name":"User Account Management","url":"https://attack.mitre.org/mitigations/M1018","kind":"course-of-action","description":"\nConsider limiting access to the BITS interface to specific users or groups.(Citation: Symantec BITS May 2007)","relationship_id":"relationship--279fa1bc-e514-4125-ab7e-51fb1da8a3f2","references":[{"source_name":"Symantec BITS May 2007","description":"Florio, E. (2007, May 9). Malware Update with Windows Update. Retrieved January 12, 2018.","url":"https://www.symantec.com/connect/blogs/malware-update-windows-update"}]},{"id":"M1028","name":"Operating System Configuration","url":"https://attack.mitre.org/mitigations/M1028","kind":"course-of-action","description":"\nConsider reducing the default BITS job lifetime in Group Policy or by editing the <code>JobInactivityTimeout</code> and <code>MaxDownloadTime</code> Registry values in <code> HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\BITS</code>.(Citation: Microsoft BITS)","relationship_id":"relationship--57d1a497-ef75-46de-b284-eefa90a99172","references":[{"source_name":"Microsoft BITS","description":"Microsoft. (n.d.). Background Intelligent Transfer Service. Retrieved January 12, 2018.","url":"https://msdn.microsoft.com/library/windows/desktop/bb968799.aspx"}]},{"id":"M1037","name":"Filter Network Traffic","url":"https://attack.mitre.org/mitigations/M1037","kind":"course-of-action","description":"Modify network and/or host firewall rules, as well as other network controls, to only allow legitimate BITS traffic.","relationship_id":"relationship--4b4d8f9e-a416-4af6-9c20-582892601668","references":[]}],"candidates":[{"id":"3c73d728-75fb-4180-a12f-6712864d7421","name":"Bitsadmin Download (cmd)","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1197/T1197.yaml","description":"This test simulates an adversary leveraging bitsadmin.exe to download\nand execute a payload\n","inputs":{"remote_file":{"description":"Remote file to download","type":"url","default":"https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1197/T1197.md"},"local_file":{"description":"Local file path to save downloaded file","type":"path","default":"%temp%\\bitsadmin1_flag.ps1"}},"dependencies":[],"source_definition_sha256":"b303585efc35293467f33d5df7d672c2e04dd5ae7c57fee5814d544ff60dae92"},{"id":"62a06ec5-5754-47d2-bcfc-123d8314c6ae","name":"Persist, Download, & Execute","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1197/T1197.yaml","description":"This test simulates an adversary leveraging bitsadmin.exe to schedule a BITS transferand execute a payload in multiple steps.\nNote that in this test, the file executed is not the one downloaded. The downloading of a random file is simply the trigger for getting bitsdamin to run an executable.\nThis has the interesting side effect of causing the executable (e.g. notepad) to run with an Initiating Process of \"svchost.exe\" and an Initiating Process Command Line of \"svchost.exe -k netsvcs -p -s BITS\"\nThis job will remain in the BITS queue until complete or for up to 90 days by default if not removed.\n","inputs":{"command_path":{"description":"Path of command to execute","type":"path","default":"C:\\Windows\\system32\\notepad.exe"},"bits_job_name":{"description":"Name of BITS job","type":"string","default":"AtomicBITS"},"local_file":{"description":"Local file path to save downloaded file","type":"path","default":"%temp%\\bitsadmin3_flag.ps1"},"remote_file":{"description":"Remote file to download","type":"url","default":"https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1197/T1197.md"}},"dependencies":[],"source_definition_sha256":"906c1263b955179b9b5f0687c08827491482e50656a11d191445be2f22f9998f"},{"id":"afb5e09e-e385-4dee-9a94-6ee60979d114","name":"Bits download using desktopimgdownldr.exe (cmd)","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1197/T1197.yaml","description":"This test simulates using desktopimgdownldr.exe to download a malicious file\ninstead of a desktop or lockscreen background img. The process that actually makes \nthe TCP connection and creates the file on the disk is a svchost process (“-k netsvc -p -s BITS”) \nand not desktopimgdownldr.exe. See https://labs.sentinelone.com/living-off-windows-land-a-new-native-file-downldr/\n","inputs":{"remote_file":{"description":"Remote file to download","type":"url","default":"https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1197/T1197.md"},"download_path":{"description":"Local file path to save downloaded file","type":"path","default":"SYSTEMROOT=C:\\Windows\\Temp"},"cleanup_path":{"description":"path to delete file as part of cleanup_command","type":"path","default":"C:\\Windows\\Temp\\Personalization\\LockScreenImage"},"cleanup_file":{"description":"file to remove as part of cleanup_command","type":"string","default":"*.md"}},"dependencies":[],"source_definition_sha256":"022313dff91e133e23af604006329b2a1cffc1d4487565a3af946907e86fe041"},{"id":"f63b8bc4-07e5-4112-acba-56f646f3f0bc","name":"Bitsadmin Download (PowerShell)","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1197/T1197.yaml","description":"This test simulates an adversary leveraging bitsadmin.exe to download\nand execute a payload leveraging PowerShell\n\nUpon execution you will find a github markdown file downloaded to the Temp directory\n","inputs":{"remote_file":{"description":"Remote file to download","type":"url","default":"https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1197/T1197.md"},"local_file":{"description":"Local file path to save downloaded file","type":"path","default":"$env:TEMP\\bitsadmin2_flag.ps1"}},"dependencies":[],"source_definition_sha256":"d9c3252049bdd157ec4836ee6b311d987e0befc522cb3e1b64b7849b3af49591"}],"simulation":{"atomic_status":"documented_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1559.001":"/ttp-simulation/techniques/enterprise/T1559.001/","T1059.001":"/ttp-simulation/techniques/enterprise/T1059.001/","T1105":"/ttp-simulation/techniques/enterprise/T1105/","T1070":"/ttp-simulation/techniques/enterprise/T1070/","T1048":"/ttp-simulation/techniques/enterprise/T1048/","T1197":"/ttp-simulation/techniques/enterprise/T1197/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1197","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0064","collector":"illustrative-lab-collector","observation":{"interpreter":"/bin/sh","command_line":"printf LAB_TELEMETRY_CHECK","actor_uid":1000,"session_id":"lab-session-1"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0082","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","initiated":true}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0060","collector":"illustrative-lab-collector","observation":{"service":"LabService","action":"install","executable":"C:\\Lab\\service.exe","actor":"lab-admin"}}]}}