Windows event log ยท Microsoft-Windows-Bits-Client/Operational61 BITS transfer has stopped
- Windows operational
- 6 fields
Microsoft-Windows-Bits-Client%4Operational.evtxMicrosoft-Windows-Bits-Client
Fields EvtxECmd extracts
6 columns in the EvtxECmd CSV
- PayloadData1
jobTitle: %jobTitle%- %jobTitle% = /Event/EventData/Data[@Name="name"]
- PayloadData2
jobId: %jobId%- %jobId% = /Event/EventData/Data[@Name="Id"]
- PayloadData3
URL: %url%- %url% = /Event/EventData/Data[@Name="url"]
- PayloadData4
Peer: %peer%- %peer% = /Event/EventData/Data[@Name="peer"]
- PayloadData5
Total Bytes: %bytesTotal% (Transferred: %bytesTransferred%)- %bytesTotal% = /Event/EventData/Data[@Name="bytesTotal"]
- %bytesTransferred% = /Event/EventData/Data[@Name="bytesTransferred"]
- PayloadData6
Bytes Transferred from Peer: %bytesTransferredFromPeer%- %bytesTransferredFromPeer% = /Event/EventData/Data[@Name="bytesTransferredFromPeer"]
Sample event
Event XML from the map file
<Event>
<System>
<Provider Name="Microsoft-Windows-Bits-Client" Guid="ef1dd15b-46c1-414e-bb95-e76b077bd51e"/>
<EventID>61</EventID>
<Version>1</Version>
<Level>3</Level>
<Task>0</Task>
<Opcode>2</Opcode>
<Keywords>0x4000030000000000</Keywords>
<TimeCreated SystemTime="2020-10-03 11:01:54.6903229"/>
<EventRecordID>667991</EventRecordID>
<Correlation ActivityID="2577e913-0e06-4ef0-944f-2c9ec57ec669"/>
<Execution ProcessID="679" ThreadID="2648"/>
<Channel>Microsoft-Windows-Bits-Client/Operational</Channel>
<Computer>HOSTNAME.domain.com</Computer>
<Security UserID="S-1-5-18"/>
</System>
<EventData>
<Data Name="transferId">2567a913-0e06-4ef0-944f-2c9ec57ec669</Data>
<Data Name="name">CCM Message Upload {0D7FE3C1-810E-43BF-98F3-6BFED5837B6C}</Data>
<Data Name="Id">f3642209-4ea2-4ea9-b502-8320d93f45f0</Data>
<Data Name="url">http://HOSTNAME.comain.com:80/CCM_Incoming/{0D7FE3C1-810E-43BF-98F3-6BFABCDEFB6C}</Data>
<Data Name="peer"></Data>
<Data Name="hr">246579813</Data>
<Data Name="fileTime">2020-08-07 01:03:05.5210175</Data>
<Data Name="fileLength">18440244073709551615</Data>
<Data Name="bytesTotal">189658</Data>
<Data Name="bytesTransferred">0</Data>
<Data Name="proxy"></Data>
<Data Name="peerProtocolFlags">0</Data>
<Data Name="bytesTransferredFromPeer">0</Data>
<Data Name="AdditionalInfoHr">0</Data>
<Data Name="PeerContextInfo">0</Data>
<Data Name="bandwidthLimit">18446744073709551615</Data>
<Data Name="ignoreBandwidthLimitsOnLan">False</Data>
</EventData>
</Event>References
7 links
- kb.eventtracker.com/evtpass/evtpages/EventId_60_Microsoft-Windows-Bits-Client_64110.asp(opens in new tab)
- jpcertcc.github.io/ToolAnalysisResultSheet/details/BITS.htm(opens in new tab)
- sans.org/reading-room/whitepapers/forensics/bits-forensics-39195(opens in new tab)
- docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc734695(v=ws.10(opens in new tab)
- adash.org/jfb/Training247/Bit_Deep_Dive_Tshoot.htm(opens in new tab)
- docs.microsoft.com/de-de/security-updates/windowsupdateservices/18127392(opens in new tab)
- github.com/nasbench/EVTX-ETW-Resources/blob/main/ETWProvidersCSVs/Internal/Microsoft-Windows-Bits-Client.csv(opens in new tab)
Source: evtx/Maps/Microsoft-Windows-Bits-Client-Operational_Microsoft-Windows-Bits-Client_61.map(opens in new tab) by Andrew Rathbun and contributors(opens in new tab), MIT License(opens in new tab)