<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4670</EventID><Version>0</Version><Level>0</Level><Task>13570</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2024-07-27T13:35:38.937960300Z'/><EventRecordID>16320196</EventRecordID><Correlation/><Execution ProcessID='4' ThreadID='332'/><Channel>Security</Channel><Computer>IP-C61302E6.prdnca.wayneint.com</Computer><Security/></System><EventData><Data Name='SubjectUserSid'>S-1-5-18</Data><Data Name='SubjectUserName'>IP-C61302E6$</Data><Data Name='SubjectDomainName'>prdnca</Data><Data Name='SubjectLogonId'>0x3e7</Data><Data Name='ObjectServer'>Security</Data><Data Name='ObjectType'>Token</Data><Data Name='ObjectName'>-</Data><Data Name='HandleId'>0x4e4</Data><Data Name='OldSd'>D:(A;;GA;;;SY)(A;;GA;;;NS)</Data><Data Name='NewSd'>D:(A;;GA;;;SY)(A;;RC;;;OW)(A;;GA;;;S-1-5-86-615999462-62705297-2911207457-59056572-3668589837)</Data><Data Name='ProcessId'>0x94c</Data><Data Name='ProcessName'>C:\Windows\System32\svchost.exe</Data></EventData><RenderingInfo Culture='en-US'><Message>Permissions on an object were changed.

Subject:
	Security ID:		S-1-5-18
	Account Name:		IP-C61302E6$
	Account Domain:		prdnca
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	Token
	Object Name:	-
	Handle ID:	0x4e4

Process:
	Process ID:	0x94c
	Process Name:	C:\Windows\System32\svchost.exe

Permissions Change:
	Original Security Descriptor:	D:(A;;GA;;;SY)(A;;GA;;;NS)
	New Security Descriptor:	D:(A;;GA;;;SY)(A;;RC;;;OW)(A;;GA;;;S-1-5-86-615999462-62705297-2911207457-59056572-3668589837)</Message><Level>Information</Level><Task>Authorization Policy Change</Task><Opcode>Info</Opcode><Channel>Security</Channel><Provider>Microsoft Windows security auditing.</Provider><Keywords><Keyword>Audit Success</Keyword></Keywords></RenderingInfo></Event>
This is a syslog message from a product called Windows Logs by Microsoft. The following fields were extracted from the message:
fieldExtractorName: windows_security_audit_xml
messageType: security_audit_event
senderHost: 10.168.2.135-SecurityEvents
sensitivity: normal
serverHostname: IP-C61302E6.prdnca.paygoint.com
sourceInfo: unknown
streamName: windows_security_audit
tags: ['eventId:4670', 'windows_security_audit', 'security_audit_event']