<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4672</EventID><Version>0</Version><Level>0</Level><Task>12548</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2024-07-29T18:03:06.110865300Z'/><EventRecordID>147390193</EventRecordID><Correlation/><Execution ProcessID='784' ThreadID='4556'/><Channel>Security</Channel><Computer>IP-C6120045.mgt.oscorpint.com</Computer><Security/></System><EventData><Data Name='SubjectUserSid'>S-1-5-21-3008783154-4189408168-2363429128-128616</Data><Data Name='SubjectUserName'>IP-C61200F2$</Data><Data Name='SubjectDomainName'>mgt</Data><Data Name='SubjectLogonId'>0x4aa9453b</Data><Data Name='PrivilegeList'>SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege</Data></EventData><RenderingInfo Culture='en-US'><Message>Special privileges assigned to new logon.

Subject:
	Security ID:		S-1-5-21-3008783154-4189408168-2363429128-128616
	Account Name:		IP-C61200F2$
	Account Domain:		mgt
	Logon ID:		0x4AA9453B

Privileges:		SeSecurityPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeTakeOwnershipPrivilege
			SeDebugPrivilege
			SeSystemEnvironmentPrivilege
			SeLoadDriverPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege
			SeEnableDelegationPrivilege</Message><Level>Information</Level><Task>Special Logon</Task><Opcode>Info</Opcode><Channel>Security</Channel><Provider>Microsoft Windows security auditing.</Provider><Keywords><Keyword>Audit Success</Keyword></Keywords></RenderingInfo></Event>
This is a syslog message from a product called Windows Logs by Microsoft. The following fields were extracted from the message:
fieldExtractorName: windows_security_audit_xml
messageType: security_audit_event
senderHost: 10.248.2.49-SecurityEvents
sensitivity: normal
serverHostname: IP-C6120045.mgt.paygoint.com
sourceInfo: unknown
streamName: windows_security_audit
tags: ['eventId:4672', 'windows_security_audit', 'security_audit_event']