BITS Event ID 59: BITS started a transfer job
Written when a Background Intelligent Transfer Service job starts, with the URL.
- Log
- Microsoft-Windows-Bits-Client/Operational
- Category
- Command and control
Why it matters
- Attackers use BITS (bitsadmin, Start-BitsTransfer) to download tools, because it looks like normal Windows traffic.
What to check
Check the URL and job name; filter out Windows Update and known software.
How to turn it on
Logged by default.
MITRE ATT&CK
- T1197 BITS Jobs
- T1105 Ingress Tool Transfer