VOOZH about

URL: https://attack.mitre.org/software/S0190/

⇱ BITSAdmin, Software S0190 | MITRE ATT&CK®

ATT&CKcon 7.0 is coming October 27-28, 2026. Learn more about ATT&CKcon 7.0 and submit your proposal.
  1. Home
  2. Software
  3. BITSAdmin

BITSAdmin

BITSAdmin is a command line tool used to create and manage BITS Jobs. [1]

ID: S0190
ⓘ
Type: TOOL
ⓘ
Platforms: Windows
Contributors: Edward Millington
Version: 1.5
Created: 18 April 2018
Last Modified: 12 May 2026
Enterprise Layer
download view 👁 Image

Techniques Used

Domain ID Name Use
Enterprise T1197 BITS Jobs

BITSAdmin can be used to create BITS Jobs to launch a malicious process.[2]
Enterprise T1048 .003 Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol

BITSAdmin can be used to create BITS Jobs to upload files from a compromised host.[1]
Enterprise T1105 Ingress Tool Transfer

BITSAdmin can be used to create BITS Jobs to upload and/or download files.[1]
Enterprise T1570 Lateral Tool Transfer

BITSAdmin can be used to create BITS Jobs to upload and/or download files from SMB file servers.[3]

Groups That Use This Software

ID Name References
G0102 Wizard Spider

[4]
G0096 APT41

[5]
G1034 Daggerfly

Daggerfly has used BITSAdmin to retrieve files from remote locations to run on victim systems.[6]
G1001 HEXANE

[7]
G1054 MirrorFace

[8]
G0065 Leviathan

[9]
G1046 Storm-1811

Storm-1811 has used BITSAdmin to download payloads.[10][11]
G0081 Tropic Trooper

[2]
G0137 Ferocious Kitten

[12]

References

×