<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4670</EventID><Version>0</Version><Level>0</Level><Task>13570</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2024-07-27T13:35:40.654290000Z'/><EventRecordID>16320218</EventRecordID><Correlation/><Execution ProcessID='4' ThreadID='5508'/><Channel>Security</Channel><Computer>IP-C61302E6.prdnca.acmeint.com</Computer><Security/></System><EventData><Data Name='SubjectUserSid'>S-1-5-18</Data><Data Name='SubjectUserName'>IP-C61302E6$</Data><Data Name='SubjectDomainName'>prdnca</Data><Data Name='SubjectLogonId'>0x3e7</Data><Data Name='ObjectServer'>Security</Data><Data Name='ObjectType'>Token</Data><Data Name='ObjectName'>-</Data><Data Name='HandleId'>0xaa4</Data><Data Name='OldSd'>D:(A;;GA;;;SY)(A;;GA;;;NS)</Data><Data Name='NewSd'>D:(A;;GA;;;SY)(A;;RC;;;OW)(A;;GA;;;S-1-5-86-615999462-62705297-2911207457-59056572-3668589837)</Data><Data Name='ProcessId'>0x94c</Data><Data Name='ProcessName'>C:\Windows\System32\svchost.exe</Data></EventData><RenderingInfo Culture='en-US'><Message>Permissions on an object were changed.

Subject:
	Security ID:		S-1-5-18
	Account Name:		IP-C61302E6$
	Account Domain:		prdnca
	Logon ID:		0x3E7

Object:
	Object Server:	Security
	Object Type:	Token
	Object Name:	-
	Handle ID:	0xaa4

Process:
	Process ID:	0x94c
	Process Name:	C:\Windows\System32\svchost.exe

Permissions Change:
	Original Security Descriptor:	D:(A;;GA;;;SY)(A;;GA;;;NS)
	New Security Descriptor:	D:(A;;GA;;;SY)(A;;RC;;;OW)(A;;GA;;;S-1-5-86-615999462-62705297-2911207457-59056572-3668589837)</Message><Level>Information</Level><Task>Authorization Policy Change</Task><Opcode>Info</Opcode><Channel>Security</Channel><Provider>Microsoft Windows security auditing.</Provider><Keywords><Keyword>Audit Success</Keyword></Keywords></RenderingInfo></Event>
{
    "fieldExtractorName": "windows_security_audit_xml",
    "message": "<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4670</EventID><Version>0</Version><Level>0</Level><Task>13570</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2024-07-27T13:35:40.654290000Z'/><EventRecordID>16320218</EventRecordID><Correlation/><Execution ProcessID='4' ThreadID='5508'/><Channel>Security</Channel><Computer>IP-C61302E6.prdnca.acmeint.com</Computer><Security/></System><EventData><Data Name='SubjectUserSid'>S-1-5-18</Data><Data Name='SubjectUserName'>IP-C61302E6$</Data><Data Name='SubjectDomainName'>prdnca</Data><Data Name='SubjectLogonId'>0x3e7</Data><Data Name='ObjectServer'>Security</Data><Data Name='ObjectType'>Token</Data><Data Name='ObjectName'>-</Data><Data Name='HandleId'>0xaa4</Data><Data Name='OldSd'>D:(A;;GA;;;SY)(A;;GA;;;NS)</Data><Data Name='NewSd'>D:(A;;GA;;;SY)(A;;RC;;;OW)(A;;GA;;;S-1-5-86-615999462-62705297-2911207457-59056572-3668589837)</Data><Data Name='ProcessId'>0x94c</Data><Data Name='ProcessName'>C:\\Windows\\System32\\svchost.exe</Data></EventData><RenderingInfo Culture='en-US'><Message>Permissions on an object were changed.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tIP-C61302E6$\r\n\tAccount Domain:\t\tprdnca\r\n\tLogon ID:\t\t0x3E7\r\n\r\nObject:\r\n\tObject Server:\tSecurity\r\n\tObject Type:\tToken\r\n\tObject Name:\t-\r\n\tHandle ID:\t0xaa4\r\n\r\nProcess:\r\n\tProcess ID:\t0x94c\r\n\tProcess Name:\tC:\\Windows\\System32\\svchost.exe\r\n\r\nPermissions Change:\r\n\tOriginal Security Descriptor:\tD:(A;;GA;;;SY)(A;;GA;;;NS)\r\n\tNew Security Descriptor:\tD:(A;;GA;;;SY)(A;;RC;;;OW)(A;;GA;;;S-1-5-86-615999462-62705297-2911207457-59056572-3668589837)</Message><Level>Information</Level><Task>Authorization Policy Change</Task><Opcode>Info</Opcode><Channel>Security</Channel><Provider>Microsoft Windows security auditing.</Provider><Keywords><Keyword>Audit Success</Keyword></Keywords></RenderingInfo></Event>",
    "messageType": "security_audit_event",
    "senderHost": "10.168.2.135-SecurityEvents",
    "sensitivity": "normal",
    "serverHostname": "IP-C61302E6.prdnca.paygoint.com",
    "sourceInfo": "unknown",
    "streamName": "windows_security_audit",
    "tags": [
        "eventId:4670",
        "windows_security_audit",
        "security_audit_event"
    ]
}