BITS Job Abuse via bitsadmin or Start-BitsTransfer to Public Hosting or IP

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•1

Detects the use of BITSAdmin or PowerShell 'Start-BitsTransfer' to download files from common public file sharing and code repository sites, which is a known technique for adversaries to stage or download malicious payloads.