BITSAdmin Payload Download and Persistence via BITS Jobs
Detects the use of BITSAdmin to download files to suspicious directories (Temp, AppData, ProgramData) or to register persistent command execution via the /SetNotifyCmdLine parameter. This detection correlates process execution events with BITS Client operational log events to confirm the completion or status of the BITS job.
Microsoft Sentinel (KQL)
