WitFoo-WinLogBeat ::: {"@metadata":{"beat":"winlogbeat","type":"_doc","version":"8.2.2"},"@timestamp":"2022-08-03T05:19:07.537Z","agent":{"ephemeral_id":"4853e543-6cb1-4d27-a0b5-92904a51b634","id":"76eb9f91-c210-4b95-9288-5a2c5f4e1a67","name":"MicroixWeb01","type":"winlogbeat","version":"8.2.2"},"ecs":{"version":"8.0.0"},"event":{"action":"Special Logon","code":"4672","created":"2022-08-03T05:19:08.302Z","kind":"event","outcome":"success","provider":"Microsoft-Windows-Security-Auditing"},"host":{"name":"MicroixWeb01"},"log":{"level":"information"},"message":"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tnighthawk\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","organization":"UMBRELLA (umbrella.umbrellacloud.com)","senderHost":"10.0.0.75","sensitivity":"normal","winlog":{"activity_id":"{7a2308e1-a15f-4433-8f98-58d3263a7489}","api":"wineventlog","channel":"Security","computer_name":"MicroixWeb01","event_data":{"PrivilegeList":"SeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","SubjectUserName":"nighthawk","SubjectUserSid":"S-1-5-18"},"event_id":"4672","keywords":["Audit Success"],"opcode":"Info","process":{"pid":708,"thread":{"id":6076}},"provider_guid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","provider_name":"Microsoft-Windows-Security-Auditing","record_id":1199548,"task":"Special Logon"}}
Product: Windows Active Directory
Vendor: Microsoft