SOFTWARE
SOFTWARE
A-B
C-D
E-F
G-H
I-J
K-L
M-N
O-P
Q-R
S-T
U-V
W-X
BITSAdmin
ID: S0190
Type: TOOL
Platforms: Windows
Contributors: Edward Millington
Version: 1.2
Created: 18 April 2018
Last Modified: 20 March 2020
Techniques Used
Domain | ID | Name | Use | |
---|---|---|---|---|
Enterprise | T1197 | BITS Jobs |
BITSAdmin can be used to create BITS Jobs to launch a malicious process.[2] |
|
Enterprise | T1048 | .003 | Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol |
BITSAdmin can be used to create BITS Jobs to upload files from a compromised host.[1] |
Enterprise | T1105 | Ingress Tool Transfer |
BITSAdmin can be used to create BITS Jobs to upload and/or download files.[1] |
|
Enterprise | T1570 | Lateral Tool Transfer |
BITSAdmin can be used to create BITS Jobs to upload and/or download files from SMB file servers.[3] |
Groups That Use This Software
ID | Name | References |
---|---|---|
G0065 | Leviathan | |
G0081 | Tropic Trooper | |
G0096 | APT41 |
References
- FireEye. (2018, March 16). Suspected Chinese Cyber Espionage Group (TEMP.Periscope) Targeting U.S. Engineering and Maritime Industries. Retrieved April 11, 2018.
- Glyer, C, et al. (2020, March). This Is Not a Test: APT41 Initiates Global Intrusion Campaign Using Multiple Exploits. Retrieved April 28, 2020.
×