detection.wiki

Microsoft-Windows-Bits-Client › Event 308

Event ID 308 — The BITS service shut down successfully, but it was delayed for number seconds.

Provider
Microsoft-Windows-Bits-Client
Channel
Operational
Level
Warning
Collection Priority
Recommended (Yamato Security)

Message #

The BITS service shut down successfully, but it was delayed for %1 seconds. This might cause delays when you turn off your computer. For more information on the delay, enable the analytic log for BITS, then stop and restart the BITS service.

Fields #

NameDescription
number Double—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Bits-Client",
    "guid": "EF1CC15B-46C1-414E-BB95-E76B077BD51E",
    "event_source_name": "",
    "event_id": 308,
    "version": 0,
    "level": 3,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2021-06-13T06:19:28.351119Z",
    "event_record_id": 17,
    "correlation": {
      "#attributes": {
        "ActivityID": "9E13646C-6014-0001-5C6E-139E1460D701"
      }
    },
    "execution": {
      "process_id": 1140,
      "thread_id": 356
    },
    "channel": "Microsoft-Windows-Bits-Client/Operational",
    "computer": "sv-dc.hinokabegakure-no-sato.local",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "number": "3199.234"
  }
}

References #