<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4674</EventID><Version>0</Version><Level>0</Level><Task>13056</Task><Opcode>0</Opcode><Keywords>0x8010000000000000</Keywords><TimeCreated SystemTime='2024-07-30T02:37:31.930464800Z'/><EventRecordID>16630044</EventRecordID><Correlation/><Execution ProcessID='4' ThreadID='3788'/><Channel>Security</Channel><Computer>IP-C61302E6.prdnca.oscorpint.com</Computer><Security/></System><EventData><Data Name='SubjectUserSid'>S-1-5-19</Data><Data Name='SubjectUserName'>LOCAL SERVICE</Data><Data Name='SubjectDomainName'>NT AUTHORITY</Data><Data Name='SubjectLogonId'>0x3e5</Data><Data Name='ObjectServer'>LSA</Data><Data Name='ObjectType'>-</Data><Data Name='ObjectName'>-</Data><Data Name='HandleId'>0x0</Data><Data Name='AccessMask'>16777216</Data><Data Name='PrivilegeList'>SeSecurityPrivilege</Data><Data Name='ProcessId'>0x278</Data><Data Name='ProcessName'>C:\Windows\System32\lsass.exe</Data></EventData><RenderingInfo Culture='en-US'><Message>An operation was attempted on a privileged object.

Subject:
	Security ID:		S-1-5-19
	Account Name:		LOCAL SERVICE
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3E5

Object:
	Object Server:	LSA
	Object Type:	-
	Object Name:	-
	Object Handle:	0x0

Process Information:
	Process ID:	0x278
	Process Name:	C:\Windows\System32\lsass.exe

Requested Operation:
	Desired Access:	16777216
	Privileges:		SeSecurityPrivilege</Message><Level>Information</Level><Task>Sensitive Privilege Use</Task><Opcode>Info</Opcode><Channel>Security</Channel><Provider>Microsoft Windows security auditing.</Provider><Keywords><Keyword>Audit Failure</Keyword></Keywords></RenderingInfo></Event>
Product: Windows Logs
Vendor: Microsoft