H3XA — Operational Evidence

TypeTool

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[BITSAdmin](https://attack.mitre.org/software/S0190) is a command line tool used to create and manage [BITS Jobs](https://attack.mitre.org/techniques/T1197). (Citation: Microsoft BITSAdmin)

Labels

tool

13 recorded

Relationships

uses

from APT41

Group

uses

to BITS Jobs

Technique

uses

to Exfiltration Over Unencrypted Non-C2 Protocol

Technique

uses

to Ingress Tool Transfer

Technique

uses

to Lateral Tool Transfer

Technique

uses

from Daggerfly

Group

uses

from Ferocious Kitten

Group

uses

from HEXANE

Group

uses

from Leviathan

Group

uses

from MirrorFace

Group

uses

from Storm-1811

Group

uses

from Tropic Trooper

Group

uses

from Wizard Spider

Group

2 external

References

mitre-attack

S0190

open

Microsoft BITSAdmin

https://msdn.microsoft.com/library/aa362813.aspx

open