Bitsadmin.exe persistence using command-line callback

Cortex XSIAM Analytics Alert Reference by Alert name

Product
Cortex XSIAM
Last date published
2024-12-03
Category
Analytics Alert Reference
Order
Alert name

Synopsis

Activation Period

14 Days

Training Period

30 Days

Test Period

N/A (single event)

Deduplication Period

1 Day

Required Data

  • Requires:
    • XDR Agent

Detection Modules

Detector Tags

ATT&CK Tactic

Persistence (TA0003)

ATT&CK Technique

BITS Jobs (T1197)

Severity

Medium

Description

BITSAdmin.exe was used with a command-line that may indicate a malware trying to gain persistence on the machine.

Attacker's Goals

Gain persistence using the legitimate bitsadmin 'setnotifycmdline' mechanism, which triggers process executions once a Bits job is done or fails.

Investigative actions

  • Check if the command line contains any malicious indicators.
  • Check if the parent process is suspicious.
  • Check if the command-line used to persist is malicious or references a malicious binary.