BITSAdmin LOLBin Download via /transfer /addfile or /setnotifycmdline
Detects the use of the BITSAdmin command-line utility to initiate file transfers from external sources to user-writable directories or temporary folders. This behavior is indicative of living-off-the-land (LotL) techniques where adversaries use legitimate system binaries to download and potentially execute malicious files.
SentinelOne
