BITS Transfer Jobs
windowsPersistence MechanismsDisk Image
Location
C:\ProgramData\Microsoft\Network\Downloader\qmgr.dbDescription
Background Intelligent Transfer Service database tracking all BITS jobs including download URL, destination path, creation time, and job owner SID.
Forensic Value
Adversaries abuse BITS jobs for stealthy file downloads and persistence because BITS transfers survive reboots and run under the SYSTEM context. Parsing qmgr.db reveals download URLs for second-stage payloads, staging paths, and the exact user account that initiated the transfer. BITS jobs do not appear in standard proxy logs if the system uses direct connections.
Tools Required
KAPEBitsParserBITS-parser (ANSSI)