BITS Abuse via bitsadmin.exe /transfer or /addfile (T1197)
Detects the use of bitsadmin.exe to create or modify BITS transfer jobs, a technique often used by adversaries to download payloads or exfiltrate data under the guise of background system tasks.
SentinelOne
