LOLBas - Bitsadmin Abuse for Command Execution
Description
LOLBas is an open-source project initiated by the security community, focused on collecting and organizing binaries, scripts, and libraries that can be used for Living Off The Land techniques.
The project primarily catalogs built-in Windows binaries and scripts that can be abused. In real-world attack scenarios, adversaries often leverage these legitimate components as part of their attack chain to bypass security defenses.
Bitsadmin.exe is a Windows tool used for managing Background Intelligent Transfer Service (BITS). By configuring a notification command to run upon task completion, Bitsadmin can be exploited to indirectly execute local programs, enabling command execution. In practical offensive and defensive scenarios, understanding and detecting the misuse of such legitimate tools can help improve the identification of stealthy threats.
Challenge Objective
Write detection rules to identify command execution operations performed using Bitsadmin.
When creating your detection query, please ensure the Computer field is included in the output for subsequent verification.
Data Sample
Data source:Sysmon,Sample data:
{ "id": 0, "Channel": "Microsoft-Windows-Sysmon/Operational", "CommandLine": "bitsadmin /SetNotifyCmdLine 6 \"cmd.exe\" \"/c ipconfig > c:\\windows\\Temp\\ipconfig.txt\"", "Company": "Microsoft Corporation", "Computer": "DESKTOP-XXXXX", "CurrentDirectory": "C:\\WINDOWS\\system32\\", "Description": "BITS administration utility", "EventId": "1", "EventRecordID": "11422", "FileVersion": "7.8.19041.1 (WinBuild.160101.0800)", "Hashes": "MD5=01AAB62D5799F75B0D69EB29C1CA6855,SHA256=739B2DD012EA183895CC01116906F339C9AA1C0BAABF6F22C8E59E25A0C12917,IMPHASH=774033454EB79213B09F788FC004A02D", "Image": "C:\\Windows\\System32\\bitsadmin.exe", "IntegrityLevel": "High", "Keywords": "0x8000000000000000", "Level": "4", "LogonGuid": "{769c9af7-1cf4-6853-8531-1c0000000000}", "LogonId": "0x1c3185", "Opcode": "0", "OriginalFileName": "bitsadmin.exe", "ParentCommandLine": "\"C:\\WINDOWS\\system32\\cmd.exe\" ", "ParentImage": "C:\\Windows\\System32\\cmd.exe", "ParentProcessGuid": "{769c9af7-fe93-6858-2c13-000000000500}", "ParentProcessId": "2240", "ParentUser": "DESKTOP-XXXXX\\admin", "ProcessGuid": "{769c9af7-ff49-6858-4013-000000000500}", "ProcessId": "6176", "Product": "Microsoft? Windows? Operating System", "ProviderGuid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "ProviderName": "Microsoft-Windows-Sysmon", "RuleName": "-", "Task": "1", "TerminalSessionId": "1", "ThreadId": "4000", "TimeCreated": "2025-06-23T07:16:25.3081654Z", "User": "DESKTOP-XXXXX\\admin", "UserId": "S-1-5-18", "UtcTime": "2025-06-23 07:16:25.306",}References
Fields
No fields found