Windows event log ยท Microsoft-Windows-Bits-Client/Operational3 BITS service created a new job
- Windows operational
- 4 fields
Microsoft-Windows-Bits-Client%4Operational.evtxMicrosoft-Windows-Bits-Client
Fields EvtxECmd extracts
4 columns in the EvtxECmd CSV
- UserName
%jobOwner%- %jobOwner% = /Event/EventData/Data[@Name="jobOwner"]
- ExecutableInfo
%processPath%- %processPath% = /Event/EventData/Data[@Name="processPath"]
- PayloadData1
jobTitle: %jobTitle%- %jobTitle% = /Event/EventData/Data[@Name="jobTitle"]
- PayloadData2
jobId: %jobId%- %jobId% = /Event/EventData/Data[@Name="jobId"]
Sample event
Event XML from the map file
<Event>
<System>
<Provider Name="Microsoft-Windows-Bits-Client" Guid="ef1cc15b-46c1-414e-bb95-e76b077bd51e"/>
<EventID>3</EventID>
<Version>2</Version>
<Level>4</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x4000000000000000</Keywords>
<TimeCreated SystemTime="2020-07-03 08:55:46.3523393"/>
<EventRecordID>2774</EventRecordID>
<Correlation/>
<Execution ProcessID="1556" ThreadID="8344"/>
<Channel>Microsoft-Windows-Bits-Client/Operational</Channel>
<Computer>MSEDGEWIN10</Computer>
<Security UserID="S-1-5-18"/>
</System>
<EventData>
<Data Name="jobTitle">Download LockScreen Image</Data>
<Data Name="jobId">ff819706-9ff9-490b-ade5-b069232c5d23</Data>
<Data Name="jobOwner">MSEDGEWIN10\IEUser</Data>
<Data Name="processPath">C:\Windows\System32\desktopimgdownldr.exe</Data>
<Data Name="processId">1996</Data>
</EventData>
</Event>
<Event>
<System>
<Provider Name="Microsoft-Windows-Bits-Client" Guid="ef1cc15b-46c1-414e-bb95-e76b077bd51e"/>
<EventID>3</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x4000000000000000</Keywords>
<TimeCreated SystemTime="2019-05-12 18:02:05.2151977"/>
<EventRecordID>3815</EventRecordID>
<Correlation/>
<Execution ProcessID="964" ThreadID="984"/>
<Channel>Microsoft-Windows-Bits-Client/Operational</Channel>
<Computer>IEWIN7</Computer>
<Security UserID="S-1-5-18"/>
</System>
<EventData>
<Data Name="string">backdoor</Data>
<Data Name="string2">IEWIN7\IEUser</Data>
<Data Name="string3"></Data>
</EventData>
</Event>References
7 links
- cecyf.fr/wp-content/uploads/2018/01/2018-CELTON-DELAHAYE-Analyse-des-jobs-BITS.pdf(opens in new tab)
- jpcertcc.github.io/ToolAnalysisResultSheet/details/BITS.htm(opens in new tab)
- adash.org/jfb/Training247/Bit_Deep_Dive_Tshoot.htm(opens in new tab)
- docs.microsoft.com/de-de/security-updates/windowsupdateservices/18127392(opens in new tab)
- docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc734695(v=ws.10(opens in new tab)
- sans.org/reading-room/whitepapers/forensics/bits-forensics-39195(opens in new tab)
- github.com/nasbench/EVTX-ETW-Resources/blob/main/ETWProvidersCSVs/Internal/Microsoft-Windows-Bits-Client.csv(opens in new tab)
Source: evtx/Maps/Microsoft-Windows-Bits-Client-Operational_Microsoft-Windows-Bits-Client_3.map(opens in new tab) by Gabriele Zambelli @gazambelli and contributors(opens in new tab), MIT License(opens in new tab)