LOL-BITSADMINCommand and Control

bitsadmin.exe Background Transfer

BITS jobs persist transfers across reboots and run as the service user — quiet exfil + download primitive.

§ Where this technique fits

LOL-BITSADMIN is catalogued under the Command and Control tactic of the offensive-security kill-chain. It appears in 1 approved dossier in the registry, typically at step 3 on average.

§ Dossiers chaining this technique

certutil + bitsadmin → AV-friendly stager chain
Initial access dropped a tiny .bat. It uses certutil to decode a base64 blob and bitsadmin to fetch the real beacon, then schtasks for persistence. Every binary is signed Microsoft.
step 3 / 6

§ What commonly comes next

01
Command and Scripting Interpreter
T1059 · Execution
seen 1×

§ Where this technique fits

§ Dossiers chaining this technique

certutil + bitsadmin → AV-friendly stager chain

§ What commonly comes next