bits.json

{
  "dataset": {
    "name": "EID Quick Reference - BITS Client",
    "version": "1.7.0",
    "generatedAt": "2026-05-10T00:00:00Z",
    "id": "https://raw.githubusercontent.com/zerber0s/windows-eid-data/main/bits.json",
    "schema": "https://raw.githubusercontent.com/zerber0s/windows-eid-data/main/schema.json",
    "license": {
      "name": "Creative Commons Attribution 4.0 International",
      "spdx": "CC-BY-4.0",
      "notice": "Event descriptions are paraphrased summaries written for this dataset. Source links point to authoritative references."
    },
    "sources": [
      {
        "name": "Microsoft Learn",
        "url": "https://learn.microsoft.com/",
        "type": "primary"
      }
    ]
  },
  "entries": [
    {
      "id": 3,
      "log": "BITS",
      "provider": "Microsoft-Windows-Bits-Client",
      "channel": "Microsoft-Windows-Bits-Client/Operational",
      "level": "Information",
      "title": "BITS job created",
      "summary": "A new BITS transfer job was created.",
      "details": "Generated when a new Background Intelligent Transfer Service (BITS) job is created. Legitimate BITS consumers include svchost.exe, Windows Update components, and known software updaters. Creation by unusual processes such as cmd.exe, powershell.exe, wscript.exe, or from user-writable paths is a strong indicator of LOLBAS abuse -- bitsadmin.exe is a LOLBin (binary), while PowerShell's Start-BitsTransfer and wscript.exe represent the Scripts category of LOLBAS.",
      "category": "BITS Transfer",
      "tags": [
        "bits",
        "lolbas",
        "file-transfer",
        "persistence"
      ],
      "relatedEventIds": [
        {
          "id": 59,
          "log": "BITS"
        },
        {
          "id": 60,
          "log": "BITS"
        },
        {
          "id": 1,
          "log": "Sysmon"
        },
        {
          "id": 3,
          "log": "Sysmon"
        }
      ],
      "mitreAttack": [
        {
          "techniqueId": "T1197",
          "techniqueName": "BITS Jobs",
          "tactics": [
            {
              "tacticId": "TA0005",
              "tacticName": "Stealth"
            },
            {
              "tacticId": "TA0003",
              "tacticName": "Persistence"
            }
          ]
        }
      ],
      "notesGuidance": {
        "investigationPivots": [
          "Correlate jobId with EID 59 to identify the download URL and EID 60 to track transfer completion",
          "Flag ProcessPath values outside of known system or software update processes"
        ],
        "commonFalsePositives": [
          "Windows Update and Microsoft software updaters",
          "Third-party software using BITS for legitimate background downloads"
        ]
      },
      "keyFields": [
        {
          "name": "jobTitle",
          "xpath": "EventData/Data[@Name='jobTitle']",
          "description": "Name assigned to the BITS job"
        },
        {
          "name": "jobId",
          "xpath": "EventData/Data[@Name='jobId']",
          "description": "Unique identifier for the BITS job; use to correlate across EID 59 and 60"
        },
        {
          "name": "jobOwner",
          "xpath": "EventData/Data[@Name='jobOwner']",
          "description": "Account that created the job"
        },
        {
          "name": "ProcessPath",
          "xpath": "EventData/Data[@Name='ProcessPath']",
          "description": "Executable that called the BITS API"
        }
      ],
      "source": {
        "name": "Microsoft Learn",
        "url": "https://learn.microsoft.com/en-us/windows/win32/bits/bits-start-page"
      },
      "volumeIndicator": "medium",
      "windowsVersions": {
        "minVersion": "Windows Vista / Server 2008"
      },
      "lastReviewed": "2026-05-10"
    },
    {
      "id": 4,
      "log": "BITS",
      "provider": "Microsoft-Windows-Bits-Client",
      "channel": "Microsoft-Windows-Bits-Client/Operational",
      "level": "Information",
      "title": "BITS job modified",
      "summary": "An existing BITS transfer job was modified.",
      "details": "Generated when an existing BITS job is modified, such as when a file is added to or removed from the job, the priority changes, or the transfer URL is updated. Adversaries using BITS for persistence or staged downloads often modify existing jobs to update C2 URLs, change destination paths, or re-add files after completion.",
      "category": "BITS Job Lifecycle",
      "tags": [
        "bits",
        "lolbas",
        "job-modification",
        "persistence",
        "c2"
      ],
      "relatedEventIds": [
        {
          "id": 3,
          "log": "BITS"
        },
        {
          "id": 59,
          "log": "BITS"
        },
        {
          "id": 60,
          "log": "BITS"
        }
      ],
      "mitreAttack": [
        {
          "techniqueId": "T1197",
          "techniqueName": "BITS Jobs",
          "tactics": [
            {
              "tacticId": "TA0003",
              "tacticName": "Persistence"
            },
            {
              "tacticId": "TA0005",
              "tacticName": "Stealth"
            }
          ]
        }
      ],
      "notesGuidance": {
        "investigationPivots": [
          "A sequence of EID 3 followed by multiple EID 4 modifications for the same jobId, especially URL changes to external addresses, indicates staged abuse",
          "Repeated URL modifications to a single jobId suggest a rotating C2 infrastructure",
          "Check if the modified destination path points to a startup folder, scheduled task directory, or script location"
        ],
        "commonFalsePositives": [
          "Windows Update modifying its own transfer jobs as updates are staged",
          "Legitimate software installers adding files to an existing BITS job during download"
        ]
      },
      "keyFields": [
        {
          "name": "jobId",
          "xpath": "EventData/Data[@Name='jobId']",
          "description": "Unique identifier for the BITS job being modified"
        },
        {
          "name": "jobName",
          "xpath": "EventData/Data[@Name='jobName']",
          "description": "Name of the BITS job"
        },
        {
          "name": "jobOwner",
          "xpath": "EventData/Data[@Name='jobOwner']",
          "description": "Account that owns the job"
        }
      ],
      "source": {
        "name": "Microsoft Learn",
        "url": "https://learn.microsoft.com/en-us/windows/win32/bits/bits-start-page"
      },
      "volumeIndicator": "medium",
      "windowsVersions": {
        "minVersion": "Windows Vista / Server 2008"
      },
      "lastReviewed": "2026-05-10"
    },
    {
      "id": 16,
      "log": "BITS",
      "provider": "Microsoft-Windows-Bits-Client",
      "channel": "Microsoft-Windows-Bits-Client/Operational",
      "level": "Information",
      "title": "BITS service stopped",
      "summary": "The Background Intelligent Transfer Service stopped.",
      "details": "Generated when the BITS service (Background Intelligent Transfer Service) stops. The BITS service stopping unexpectedly or being explicitly stopped is a potential defense evasion or anti-forensic indicator. Some malware stops BITS after using it for staging to remove the transfer evidence, or stops it to prevent legitimate Windows Update transfers while maintaining persistence.",
      "category": "BITS Service Lifecycle",
      "tags": [
        "bits",
        "lolbas",
        "service-stop",
        "defense-evasion"
      ],
      "relatedEventIds": [
        {
          "id": 3,
          "log": "BITS"
        },
        {
          "id": 60,
          "log": "BITS"
        }
      ],
      "mitreAttack": [
        {
          "techniqueId": "T1489",
          "techniqueName": "Service Stop",
          "tactics": [
            {
              "tacticId": "TA0040",
              "tacticName": "Impact"
            }
          ]
        }
      ],
      "notesGuidance": {
        "investigationPivots": [
          "Correlate with EID 3/60 from earlier in the same session to determine if BITS was used before stopping",
          "Check if the stop was triggered by an sc.exe, net.exe, or PowerShell Stop-Service command — use process creation logs",
          "Repeated BITS start/stop cycles correlated with file staging events suggest automated malware cleanup"
        ],
        "commonFalsePositives": [
          "Normal Windows service lifecycle — BITS stops when idle and restarts when needed",
          "Scheduled system maintenance or Windows Update completion stopping BITS"
        ]
      },
      "source": {
        "name": "Microsoft Learn",
        "url": "https://learn.microsoft.com/en-us/windows/win32/bits/bits-start-page"
      },
      "volumeIndicator": "medium",
      "windowsVersions": {
        "minVersion": "Windows Vista / Server 2008"
      },
      "lastReviewed": "2026-04-07"
    },
    {
      "id": 59,
      "log": "BITS",
      "provider": "Microsoft-Windows-Bits-Client",
      "channel": "Microsoft-Windows-Bits-Client/Operational",
      "level": "Information",
      "title": "BITS job transfer started",
      "summary": "A BITS job began transferring data; URL recorded.",
      "details": "Generated when a BITS job begins actively transferring data. The url field is the highest-value forensic artifact in the BITS log, revealing the C2 server, staging server, or exfiltration endpoint. Attackers commonly use bitsadmin.exe or PowerShell's Start-BitsTransfer to download payloads from attacker-controlled infrastructure.",
      "category": "BITS Transfer",
      "tags": [
        "bits",
        "lolbas",
        "file-transfer",
        "c2"
      ],
      "relatedEventIds": [
        {
          "id": 3,
          "log": "BITS"
        },
        {
          "id": 60,
          "log": "BITS"
        },
        {
          "id": 3,
          "log": "Sysmon"
        }
      ],
      "mitreAttack": [
        {
          "techniqueId": "T1197",
          "techniqueName": "BITS Jobs",
          "tactics": [
            {
              "tacticId": "TA0005",
              "tacticName": "Stealth"
            },
            {
              "tacticId": "TA0003",
              "tacticName": "Persistence"
            }
          ]
        }
      ],
      "notesGuidance": {
        "investigationPivots": [
          "The url field reveals the download source or upload destination — check against threat intel",
          "Correlate jobId with EID 3 (ProcessPath) to identify what initiated the transfer",
          "External URLs (non-Microsoft, non-CDN) from unexpected processes are high-fidelity malicious indicators"
        ],
        "commonFalsePositives": [
          "Windows Update downloading patches",
          "Legitimate software downloading updates via BITS"
        ]
      },
      "keyFields": [
        {
          "name": "jobTitle",
          "xpath": "EventData/Data[@Name='jobTitle']",
          "description": "Name of the BITS job"
        },
        {
          "name": "jobId",
          "xpath": "EventData/Data[@Name='jobId']",
          "description": "Unique identifier for the BITS job"
        },
        {
          "name": "jobOwner",
          "xpath": "EventData/Data[@Name='jobOwner']",
          "description": "Account that owns the job"
        },
        {
          "name": "url",
          "xpath": "EventData/Data[@Name='url']",
          "description": "Remote URL being downloaded from or uploaded to"
        },
        {
          "name": "bytesTotal",
          "xpath": "EventData/Data[@Name='bytesTotal']",
          "description": "Total bytes to be transferred"
        },
        {
          "name": "fileCount",
          "xpath": "EventData/Data[@Name='fileCount']",
          "description": "Number of files in the transfer job"
        }
      ],
      "source": {
        "name": "Microsoft Learn",
        "url": "https://learn.microsoft.com/en-us/windows/win32/bits/bits-start-page"
      },
      "volumeIndicator": "medium",
      "windowsVersions": {
        "minVersion": "Windows Vista / Server 2008"
      },
      "lastReviewed": "2026-05-10"
    },
    {
      "id": 60,
      "log": "BITS",
      "provider": "Microsoft-Windows-Bits-Client",
      "channel": "Microsoft-Windows-Bits-Client/Operational",
      "level": "Information",
      "title": "BITS job transfer stopped",
      "summary": "A BITS job finished transferring data (completed or halted).",
      "details": "Generated when a BITS job stops transferring, either because it completed successfully or was interrupted. A transfer that stopped significantly short of bytesTotal (from EID 59) may indicate detection and intervention, network interruption, or a partial exfiltration.",
      "category": "BITS Transfer",
      "tags": [
        "bits",
        "lolbas",
        "file-transfer"
      ],
      "relatedEventIds": [
        {
          "id": 3,
          "log": "BITS"
        },
        {
          "id": 59,
          "log": "BITS"
        },
        {
          "id": 3,
          "log": "Sysmon"
        }
      ],
      "mitreAttack": [
        {
          "techniqueId": "T1197",
          "techniqueName": "BITS Jobs",
          "tactics": [
            {
              "tacticId": "TA0005",
              "tacticName": "Stealth"
            },
            {
              "tacticId": "TA0003",
              "tacticName": "Persistence"
            }
          ]
        }
      ],
      "notesGuidance": {
        "investigationPivots": [
          "Compare bytesTransferred against bytesTotal from EID 59 to assess whether the transfer completed",
          "Correlate jobId with EID 3 and EID 59 to build the full transfer picture",
          "A completed transfer to an external URL identified in EID 59 confirms successful data staging or C2 download"
        ],
        "commonFalsePositives": [
          "Any legitimate BITS transfer completing normally"
        ]
      },
      "keyFields": [
        {
          "name": "jobTitle",
          "xpath": "EventData/Data[@Name='jobTitle']",
          "description": "Name of the BITS job"
        },
        {
          "name": "jobId",
          "xpath": "EventData/Data[@Name='jobId']",
          "description": "Unique identifier for the BITS job"
        },
        {
          "name": "jobOwner",
          "xpath": "EventData/Data[@Name='jobOwner']",
          "description": "Account that owns the job"
        },
        {
          "name": "bytesTransferred",
          "xpath": "EventData/Data[@Name='bytesTransferred']",
          "description": "Number of bytes actually transferred; compare with bytesTotal from EID 59"
        },
        {
          "name": "url",
          "xpath": "EventData/Data[@Name='url']",
          "description": "Remote URL involved in the transfer"
        }
      ],
      "source": {
        "name": "Microsoft Learn",
        "url": "https://learn.microsoft.com/en-us/windows/win32/bits/bits-start-page"
      },
      "volumeIndicator": "medium",
      "windowsVersions": {
        "minVersion": "Windows Vista / Server 2008"
      },
      "lastReviewed": "2026-05-10"
    },
    {
      "id": 61,
      "log": "BITS",
      "provider": "Microsoft-Windows-Bits-Client",
      "channel": "Microsoft-Windows-Bits-Client/Operational",
      "level": "Warning",
      "title": "BITS job error",
      "summary": "A BITS transfer job encountered an error.",
      "details": "Generated when a BITS job fails or is cancelled due to an error. This event is forensically valuable even when the transfer ultimately fails because it records the remote URL and local destination that were attempted, revealing C2 infrastructure or staging paths. Repeated BITS errors against the same external host from multiple endpoints is a lateral movement or beaconing indicator. HTTP 403/404/401 error codes indicate the attacker's infrastructure was reachable but the specific resource was unavailable or access-controlled.",
      "category": "BITS Job Lifecycle",
      "tags": [
        "bits",
        "lolbas",
        "job-error",
        "c2",
        "exfiltration"
      ],
      "relatedEventIds": [
        {
          "id": 3,
          "log": "BITS"
        },
        {
          "id": 59,
          "log": "BITS"
        },
        {
          "id": 60,
          "log": "BITS"
        }
      ],
      "mitreAttack": [
        {
          "techniqueId": "T1197",
          "techniqueName": "BITS Jobs",
          "tactics": [
            {
              "tacticId": "TA0003",
              "tacticName": "Persistence"
            },
            {
              "tacticId": "TA0005",
              "tacticName": "Stealth"
            }
          ]
        }
      ],
      "notesGuidance": {
        "investigationPivots": [
          "The URL in the error event is the primary pivot — extract the domain/IP and check against threat intelligence",
          "Destination path reveals where the payload would have landed — check if it is a persistence location",
          "Multiple hosts failing to reach the same external URL in the same time window suggests a coordinated staged download campaign"
        ],
        "commonFalsePositives": [
          "Windows Update transfer failures during connectivity interruptions",
          "Legitimate software updaters using BITS that encounter server-side errors"
        ]
      },
      "keyFields": [
        {
          "name": "jobId",
          "xpath": "EventData/Data[@Name='jobId']",
          "description": "Unique identifier for the BITS job that failed"
        },
        {
          "name": "jobName",
          "xpath": "EventData/Data[@Name='jobName']",
          "description": "Name of the BITS job"
        },
        {
          "name": "jobOwner",
          "xpath": "EventData/Data[@Name='jobOwner']",
          "description": "Account that owns the job"
        },
        {
          "name": "url",
          "xpath": "EventData/Data[@Name='url']",
          "description": "Remote URL that the transfer attempted to reach"
        },
        {
          "name": "errorCode",
          "xpath": "EventData/Data[@Name='errorCode']",
          "description": "HRESULT or HTTP status code indicating the failure reason"
        }
      ],
      "source": {
        "name": "Microsoft Learn",
        "url": "https://learn.microsoft.com/en-us/windows/win32/bits/bits-start-page"
      },
      "volumeIndicator": "low",
      "windowsVersions": {
        "minVersion": "Windows Vista / Server 2008"
      },
      "lastReviewed": "2026-05-10"
    }
  ]
}