detection.wiki

Microsoft-Windows-Bits-Client › Event 61

Event ID 61 — BITS stopped transferring the name transfer job that is associated with the url URL.

Provider
Microsoft-Windows-Bits-Client
Channel
Operational
Level
Warning
Collection Priority
Recommended (Yamato Security)
Opcode
Stop

Description

BITS stopped transferring the name transfer job that is associated with the url URL. The status code is hr.

Message #

BITS stopped transferring the %2 transfer job that is associated with the %4 URL. The status code is %6.

Fields #

NameDescription
transferId GUID—
name UnicodeString—
Id GUID—
url UnicodeString—
peer UnicodeString—
hr UInt32—
fileTime FILETIME—
fileLength UInt64—
bytesTotal UInt64—
bytesTransferred UInt64—
proxy UnicodeString—
peerProtocolFlags UInt64—
bytesTransferredFromPeer UInt64—
AdditionalInfoHr UInt32—
PeerContextInfo UInt32—
bandwidthLimit UInt64—
ignoreBandwidthLimitsOnLan Boolean—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Bits-Client",
    "guid": "EF1CC15B-46C1-414E-BB95-E76B077BD51E",
    "event_source_name": "",
    "event_id": 61,
    "version": 1,
    "level": 3,
    "task": 0,
    "opcode": 2,
    "keywords": 4611686018427387904,
    "time_created": "2023-10-25T21:23:18.535833+00:00",
    "event_record_id": 25,
    "correlation": {
      "ActivityID": "B93FF5C2-FB5D-428C-88AE-EE3A7EE94E1C"
    },
    "execution": {
      "process_id": 4816,
      "thread_id": 2800
    },
    "channel": "Microsoft-Windows-Bits-Client/Operational",
    "computer": "WinDevEval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "transferId": "B93FF5C2-FB5D-428C-88AE-EE3A7EE94E1C",
    "name": "Font Download",
    "Id": "0732C691-11CC-4489-AA3A-006D80128165",
    "url": "https://fs.microsoft.com/fs/windows/fontset-2017-04.json",
    "peer": "",
    "hr": 2149580817,
    "fileTime": "1601-01-01T00:00:00.000000Z",
    "fileLength": 18446744073709551615,
    "bytesTotal": 18446744073709551615,
    "bytesTransferred": 0,
    "proxy": "",
    "peerProtocolFlags": 0,
    "bytesTransferredFromPeer": 0,
    "AdditionalInfoHr": 0,
    "PeerContextInfo": 0,
    "bandwidthLimit": 18446744073709551615,
    "ignoreBandwidthLimitsOnLan": false
  },
  "message": ""
}

References #