WitFoo-WinLogBeat ::: {"@metadata":{"beat":"winlogbeat","type":"_doc","version":"8.2.2"},"@timestamp":"2022-09-30T10:29:02.060Z","agent":{"ephemeral_id":"36976287-4fe3-40b9-a82f-3692c2392d77","id":"6846763b-21b7-49f0-ab99-104d7b3b0a78","name":"ADAudit1","type":"winlogbeat","version":"8.2.2"},"ecs":{"version":"8.0.0"},"event":{"action":"Special Logon","code":"4672","created":"2022-09-30T10:29:03.649Z","kind":"event","outcome":"success","provider":"Microsoft-Windows-Security-Auditing"},"host":{"name":"ADAudit1.oscorp.org"},"log":{"level":"information"},"message":"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tjohndoe\n\tAccount Domain:\t\tOSCORP\n\tLogon ID:\t\t0xA8AA552\n\nPrivileges:\t\tSeSecurityPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","organization":"OSCORP (oscorp.oscorpcloud.com)","senderHost":"ADAudit1.oscorp.org","sensitivity":"normal","winlog":{"activity_id":"{2692d4fa-34c2-4626-bb80-c9fc33265209}","api":"wineventlog","channel":"Security","computer_name":"ADAudit1.oscorp.org","event_data":{"PrivilegeList":"SeSecurityPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","SubjectDomainName":"OSCORP","SubjectLogonId":"0xa8aa552","SubjectUserName":"johndoe","SubjectUserSid":"S-1-5-18"},"event_id":"4672","keywords":["Audit Success"],"opcode":"Info","process":{"pid":712,"thread":{"id":756}},"provider_guid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","provider_name":"Microsoft-Windows-Security-Auditing","record_id":5016542,"task":"Special Logon"}}
{
    "senderhost": "ADAudit1.uwca.org",
    "severitylabel": "Info",
    "tags": [
        "v8",
        "eventId:4672",
        "microsoft-windows-security-auditing",
        "security_privilege_change"
    ],
    "productids": [
        43
    ],
    "sourceinfo": "unknown",
    "message": "WitFoo-WinLogBeat ::: {\"@metadata\":{\"beat\":\"winlogbeat\",\"type\":\"_doc\",\"version\":\"8.2.2\"},\"@timestamp\":\"2022-09-30T10:29:02.060Z\",\"agent\":{\"ephemeral_id\":\"36976287-4fe3-40b9-a82f-3692c2392d77\",\"id\":\"6846763b-21b7-49f0-ab99-104d7b3b0a78\",\"name\":\"ADAudit1\",\"type\":\"winlogbeat\",\"version\":\"8.2.2\"},\"ecs\":{\"version\":\"8.0.0\"},\"event\":{\"action\":\"Special Logon\",\"code\":\"4672\",\"created\":\"2022-09-30T10:29:03.649Z\",\"kind\":\"event\",\"outcome\":\"success\",\"provider\":\"Microsoft-Windows-Security-Auditing\"},\"host\":{\"name\":\"ADAudit1.oscorp.org\"},\"log\":{\"level\":\"information\"},\"message\":\"Special privileges assigned to new logon.\\n\\nSubject:\\n\\tSecurity ID:\\t\\tS-1-5-18\\n\\tAccount Name:\\t\\tjohndoe\\n\\tAccount Domain:\\t\\tOSCORP\\n\\tLogon ID:\\t\\t0xA8AA552\\n\\nPrivileges:\\t\\tSeSecurityPrivilege\\n\\t\\t\\tSeBackupPrivilege\\n\\t\\t\\tSeRestorePrivilege\\n\\t\\t\\tSeTakeOwnershipPrivilege\\n\\t\\t\\tSeDebugPrivilege\\n\\t\\t\\tSeSystemEnvironmentPrivilege\\n\\t\\t\\tSeLoadDriverPrivilege\\n\\t\\t\\tSeImpersonatePrivilege\\n\\t\\t\\tSeDelegateSessionUserImpersonatePrivilege\",\"organization\":\"OSCORP (oscorp.oscorpcloud.com)\",\"senderHost\":\"ADAudit1.oscorp.org\",\"sensitivity\":\"normal\",\"winlog\":{\"activity_id\":\"{2692d4fa-34c2-4626-bb80-c9fc33265209}\",\"api\":\"wineventlog\",\"channel\":\"Security\",\"computer_name\":\"ADAudit1.oscorp.org\",\"event_data\":{\"PrivilegeList\":\"SeSecurityPrivilege\\n\\t\\t\\tSeBackupPrivilege\\n\\t\\t\\tSeRestorePrivilege\\n\\t\\t\\tSeTakeOwnershipPrivilege\\n\\t\\t\\tSeDebugPrivilege\\n\\t\\t\\tSeSystemEnvironmentPrivilege\\n\\t\\t\\tSeLoadDriverPrivilege\\n\\t\\t\\tSeImpersonatePrivilege\\n\\t\\t\\tSeDelegateSessionUserImpersonatePrivilege\",\"SubjectDomainName\":\"OSCORP\",\"SubjectLogonId\":\"0xa8aa552\",\"SubjectUserName\":\"johndoe\",\"SubjectUserSid\":\"S-1-5-18\"},\"event_id\":\"4672\",\"keywords\":[\"Audit Success\"],\"opcode\":\"Info\",\"process\":{\"pid\":712,\"thread\":{\"id\":756}},\"provider_guid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"provider_name\":\"Microsoft-Windows-Security-Auditing\",\"record_id\":5016542,\"task\":\"Special Logon\"}}",
    "sensitivity": "normal",
    "messagetype": "security_privilege_change",
    "vendorcode": "5016542",
    "action": "Special Logon",
    "streamName": "microsoft-windows-security-auditing",
    "userName": "johndoe"
}