---
{
  "title": "BITS Jobs",
  "summary": "BITS job abuse uses Windows background transfer functionality for unauthorized transfers or recurring activity.",
  "topic": "soc",
  "level": "Intermediate",
  "updated": "2026-10-12",
  "published": "2026-10-04",
  "units": [
    2
  ],
  "aliases": [
    "T1197"
  ],
  "sources": [
    {
      "title": "MITRE ATT&CK T1197: BITS Jobs",
      "url": "https://attack.mitre.org/techniques/T1197"
    }
  ],
  "editorialVersion": 2
}
---

## Background transfer is a legitimate service

BITS, the Windows Background Intelligent Transfer Service, supports asynchronous file transfers used by legitimate applications such as update mechanisms. A transfer is represented by a job with associated information about its owner, files, state, and other behavior. Abuse uses that normal service for unauthorized transfers or recurring activity.

The presence of BITS is therefore not evidence of compromise. Investigators need to examine the specific job, how it was created, the remote and local locations involved, and any behavior associated with completion or failure.

## Investigate an unusual job

A fictional endpoint alert identifies a background transfer to a destination unrelated to the organization's update services. The analyst reviews the job owner, creation time, source and destination, state changes, and relevant process or service records.

A software vendor's updater might explain the transfer. The team checks the installed product, expected update infrastructure, deployment history, and file produced by the job. A plausible job name does not establish legitimacy because names can be chosen independently of the actual content and destination.

Where the job includes follow-on behavior, examine what is requested and whether it executed. A configured action and a completed action are different facts. Correlate with endpoint process and file evidence rather than assuming every job reached its final stage.

## Follow the lifecycle

Background jobs can outlast the process that initially created them. Stopping a suspicious command-line process may therefore leave the transfer job available to continue later. The investigation should establish the job's current state and the system's handling of pending or retrying work.

Preserve relevant job details before cancellation where practical. Otherwise cleanup may remove information about ownership, locations, and the relationship to other events. Available artifacts and telemetry depend on the Windows version and monitoring configuration.

[[logs-and-telemetry]] provides the evidence discipline for interpreting those records. [[persistence]] explains why a long-lived or repeatable mechanism can matter after the first visible process disappears.

## Choose a targeted response

Cancel or restrict an unauthorized job through an approved process, review its transferred files and any resulting execution, and investigate the access that created it. Disabling the entire service without considering dependencies can disrupt legitimate updates and other applications.

For practice, create a paper comparison of an approved software-update job and an unexplained transfer owned by an ordinary staff account. Identify which job fields, process records, and operational documentation distinguish them. Explain what evidence would be needed to claim that downloaded content executed. Map supported behavior through [[mitre-attack]] and coordinate broader actions through [[incident-response]].

## Related concepts

- [[inter-process-communication]]
- [[command-and-scripting-interpreter]]
- [[ingress-tool-transfer]]
- [[indicator-removal]]