DFIRHub

Windows event log ยท Microsoft-Windows-Bits-Client/Operational59 BITS transfer has started

  • Windows operational
  • 6 fields
  • Microsoft-Windows-Bits-Client%4Operational.evtx
  • Microsoft-Windows-Bits-Client

Fields EvtxECmd extracts

6 columns in the EvtxECmd CSV

  • PayloadData1jobTitle: %jobTitle%
    • %jobTitle% = /Event/EventData/Data[@Name="name"]
  • PayloadData2jobId: %jobId%
    • %jobId% = /Event/EventData/Data[@Name="Id"]
  • PayloadData3URL: %url%
    • %url% = /Event/EventData/Data[@Name="url"]
  • PayloadData4Peer: %peer%
    • %peer% = /Event/EventData/Data[@Name="peer"]
  • PayloadData5Total Bytes: %bytesTotal% (Transferred: %bytesTransferred%)
    • %bytesTotal% = /Event/EventData/Data[@Name="bytesTotal"]
    • %bytesTransferred% = /Event/EventData/Data[@Name="bytesTransferred"]
  • PayloadData6Bytes Transferred from Peer: %bytesTransferredFromPeer%
    • %bytesTransferredFromPeer% = /Event/EventData/Data[@Name="bytesTransferredFromPeer"]

Sample event

Event XML from the map file

<Event>
  <System>
    <Provider Name="Microsoft-Windows-Bits-Client" Guid="ef6y679b-46c1-414e-bb95-e76b077bd51e"/>
    <EventID>59</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>1</Opcode>
    <Keywords>0x4000900000000000</Keywords>
    <TimeCreated SystemTime="2019-02-17 11:23:12.2815793"/>
    <EventRecordID>16907</EventRecordID>
    <Correlation ActivityID="f56796f9-02a6-4bdf-9967-f21c8f1d4b54"/>
    <Execution ProcessID="679" ThreadID="2580"/>
    <Channel>Microsoft-Windows-Bits-Client/Operational</Channel>
    <Computer>HOSTNAME.domain.com</Computer>
    <Security UserID="S-1-5-18"/>
  </System>
  <EventData>
    <Data Name="transferId">f5e116f9-02a6-4bdf-9967-f21c8f1d4b54</Data>
    <Data Name="name">name</Data>
    <Data Name="Id">c29ef679-6c03-4644-992d-b7fe884e117b</Data>
    <Data Name="url">URL</Data>
    <Data Name="peer"></Data>
    <Data Name="fileTime">2001-01-01 00:00:00.0000000</Data>
    <Data Name="fileLength">679</Data>
    <Data Name="bytesTotal">679</Data>
    <Data Name="bytesTransferred">0</Data>
    <Data Name="bytesTransferredFromPeer">0</Data>
  </EventData>
</Event>

References

7 links

Source: evtx/Maps/Microsoft-Windows-Bits-Client-Operational_Microsoft-Windows-Bits-Client_59.map(opens in new tab) by Mark Hallman and contributors(opens in new tab), MIT License(opens in new tab)