Windows event log ยท Microsoft-Windows-Bits-Client/Operational3 BITS service created a new job

  • Windows operational
  • 4 fields
  • Microsoft-Windows-Bits-Client%4Operational.evtx
  • Microsoft-Windows-Bits-Client

Fields EvtxECmd extracts

4 columns in the EvtxECmd CSV

  • UserName%jobOwner%
    • %jobOwner% = /Event/EventData/Data[@Name="jobOwner"]
  • ExecutableInfo%processPath%
    • %processPath% = /Event/EventData/Data[@Name="processPath"]
  • PayloadData1jobTitle: %jobTitle%
    • %jobTitle% = /Event/EventData/Data[@Name="jobTitle"]
  • PayloadData2jobId: %jobId%
    • %jobId% = /Event/EventData/Data[@Name="jobId"]

Sample event

Event XML from the map file

<Event>
  <System>
    <Provider Name="Microsoft-Windows-Bits-Client" Guid="ef1cc15b-46c1-414e-bb95-e76b077bd51e"/>
    <EventID>3</EventID>
    <Version>2</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x4000000000000000</Keywords>
    <TimeCreated SystemTime="2020-07-03 08:55:46.3523393"/>
    <EventRecordID>2774</EventRecordID>
    <Correlation/>
    <Execution ProcessID="1556" ThreadID="8344"/>
    <Channel>Microsoft-Windows-Bits-Client/Operational</Channel>
    <Computer>MSEDGEWIN10</Computer>
    <Security UserID="S-1-5-18"/>
  </System>
  <EventData>
    <Data Name="jobTitle">Download LockScreen Image</Data>
    <Data Name="jobId">ff819706-9ff9-490b-ade5-b069232c5d23</Data>
    <Data Name="jobOwner">MSEDGEWIN10\IEUser</Data>
    <Data Name="processPath">C:\Windows\System32\desktopimgdownldr.exe</Data>
    <Data Name="processId">1996</Data>
  </EventData>
</Event>
<Event>
  <System>
    <Provider Name="Microsoft-Windows-Bits-Client" Guid="ef1cc15b-46c1-414e-bb95-e76b077bd51e"/>
    <EventID>3</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x4000000000000000</Keywords>
    <TimeCreated SystemTime="2019-05-12 18:02:05.2151977"/>
    <EventRecordID>3815</EventRecordID>
    <Correlation/>
    <Execution ProcessID="964" ThreadID="984"/>
    <Channel>Microsoft-Windows-Bits-Client/Operational</Channel>
    <Computer>IEWIN7</Computer>
    <Security UserID="S-1-5-18"/>
  </System>
  <EventData>
    <Data Name="string">backdoor</Data>
    <Data Name="string2">IEWIN7\IEUser</Data>
    <Data Name="string3"></Data>
  </EventData>
</Event>

References

7 links

Source: evtx/Maps/Microsoft-Windows-Bits-Client-Operational_Microsoft-Windows-Bits-Client_3.map(opens in new tab) by Gabriele Zambelli @gazambelli and contributors(opens in new tab), MIT License(opens in new tab)