Skip to content

BITS Jobs

Technique · ATTACK:enterprise:T1197

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1197",
  "title": "BITS Jobs",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1197",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--c8e87b83-edbb-48d4-9295-4974897525b7",
  "external_id": "T1197",
  "domain": "enterprise",
  "created": "2018-04-18T17:59:24.739Z",
  "modified": "2026-05-12T15:12:00.716Z",
  "version": "2.0",
  "aliases": [

  ],
  "tactics": [
    "stealth",
    "persistence",
    "execution"
  ],
  "source_references": [
    {
      "source_name": "CTU BITS Malware June 2016",
      "url": "https://www.secureworks.com/blog/malware-lingers-with-bits"
    },
    {
      "source_name": "Symantec BITS May 2007",
      "url": "https://www.symantec.com/connect/blogs/malware-update-windows-update"
    },
    {
      "source_name": "PaloAlto UBoatRAT Nov 2017",
      "url": "https://researchcenter.paloaltonetworks.com/2017/11/unit42-uboatrat-navigates-east-asia/"
    },
    {
      "source_name": "Microsoft BITS",
      "url": "https://msdn.microsoft.com/library/windows/desktop/bb968799.aspx"
    },
    {
      "source_name": "Microsoft BITSAdmin",
      "url": "https://msdn.microsoft.com/library/aa362813.aspx"
    },
    {
      "source_name": "Microsoft COM",
      "url": "https://msdn.microsoft.com/library/windows/desktop/ms680573.aspx"
    },
    {
      "source_name": "Mondok Windows PiggyBack BITS May 2007",
      "url": "https://arstechnica.com/information-technology/2007/05/malware-piggybacks-on-windows-background-intelligent-transfer-service/"
    }
  ]
}

Explicit source assertions (16)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S0652 → uses → ATTACK:enterprise:T1197

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0ff081b9-5dde-4b48-a90f-3baf26b32a16

Kaspersky Ferocious Kitten Jun 2021

ATTACK:enterprise:G0040 → uses → ATTACK:enterprise:T1197

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--19cc1620-de41-4076-b5b8-9d64364a578a

Unit 42 BackConfig May 2020

ATTACK:enterprise:S0534 → uses → ATTACK:enterprise:T1197

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2296f1da-0910-46ee-81f7-5d10cb8753cd

NCC Group Team9 June 2020

ATTACK:enterprise:M1018 → mitigates → ATTACK:enterprise:T1197

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--279fa1bc-e514-4125-ab7e-51fb1da8a3f2

Symantec BITS May 2007

ATTACK:enterprise:S0154 → uses → ATTACK:enterprise:T1197

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2d0748e3-7427-4847-9861-75680f6aacb3

Talos Cobalt Strike September 2020 · Cobalt Strike Manual 4.3 November 2020 · CobaltStrike Scripted Web Delivery

ATTACK:enterprise:S0554 → uses → ATTACK:enterprise:T1197

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--35e66e21-edaf-46ed-8cec-32ba4ce92aa4

Intrinsec Egregor Nov 2020

ATTACK:enterprise:S0201 → uses → ATTACK:enterprise:T1197

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--45d8c4f2-27e4-4063-9eec-d8023c61c74b

Microsoft PLATINUM April 2016

ATTACK:enterprise:M1037 → mitigates → ATTACK:enterprise:T1197

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4b4d8f9e-a416-4af6-9c20-582892601668

ATTACK:enterprise:S0333 → uses → ATTACK:enterprise:T1197

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4f290a4e-983c-460f-b00c-e1bc8dd4d413

PaloAlto UBoatRAT Nov 2017

ATTACK:enterprise:M1028 → mitigates → ATTACK:enterprise:T1197

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--57d1a497-ef75-46de-b284-eefa90a99172

ATTACK:enterprise:S0654 → uses → ATTACK:enterprise:T1197

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--94e040f2-c1e7-4159-839f-c4a2497232f3

Group IB Ransomware September 2020

ATTACK:enterprise:G0065 → uses → ATTACK:enterprise:T1197

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b5894858-3f86-48f4-8ae0-7fcb8c19c36b

FireEye Periscope March 2018

ATTACK:enterprise:G0087 → uses → ATTACK:enterprise:T1197

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c6b51e0c-d6a8-4815-b1fe-fb065ac0bcaa

FBI FLASH APT39 September 2020

ATTACK:enterprise:S0190 → uses → ATTACK:enterprise:T1197

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cdf7492f-4cdd-4119-aa5e-0d94a07a3965

TrendMicro Tropic Trooper Mar 2018

ATTACK:enterprise:G0096 → uses → ATTACK:enterprise:T1197

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d316289b-26fa-49d7-8ed0-3fa56cc858b7

FireEye APT41 March 2020 · Crowdstrike GTR2020 Mar 2020

ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:T1197

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fb229043-04d8-40e8-a155-bd2471bfc5c3

Mandiant FIN12 Oct 2021

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.