This anomaly detects explicit Windows BITS (Background Intelligent Transfer Service) upload activity indicative of data exfiltration. It flags usage of BITSAdmin with /Create or /Transfer combined with /Upload or /Upload-Reply, as well as PowerShell Start-BitsTransfer invocations with -TransferType Upload or UploadReply. The detection leverages endpoint telemetry via the Endpoint data model (Processes) sourced from Sysmon Event ID 1, Windows Security event 4688, and CrowdStrike ProcessRollup2. The search looks for bitsadmin.exe or PowerShell processes invoking BITS upload commands and captures associated command lines, destinations, user context, and parent processes. It maps detections to MITRE techniques T1197 (BITS Jobs) and T1048 (Exfiltration). The rule includes drill-down and intermediate findings to pinpoint the source process, destination, and user, and provides guidance for investigation through risk events and analytic stories such as “BITS Jobs” and “Living Off The Land.” It also documents known false positives (administrative bundles, diagnostics, and authorized tests that legitimately upload files) and references Microsoft and security analyses. Implementation requires ingesting complete process command lines from EDR telemetry, mapping to the Endpoint CIM, and normalizing fields for efficient detection and alerting.