BITS tasks are self-contained in the BITS job database. These tasks allow Persistence by creating jobs which last a long time (the default maximum time is 90 days), or by invoking an arbitrary program when a job completes or errors (this includes after system reboots)
BITS Jobs Analysis
RED TEAM: ATTACK
A Bits Job is setup to transfer cmd.exe to 3 arbitrary file names. The Bits Job commands which were run as seen through a SIEM solution are below, using this we can establish our persistence. The end result is whenever the specified files are ‘transferred’, which in this case is essentially a copy, the calculator is executed on this host.
BLUE TEAM: DEFEND
This can sometimes be detected through Event ID 64 under Microsoft-Windows-Bits-Client/Operational and can be viewed on a system with live triage
bitsadmin /list /allusers /verbose