WitFoo-WinLogBeat ::: {"@metadata":{"beat":"winlogbeat","type":"_doc","version":"8.1.3"},"@timestamp":"2022-08-10T14:02:19.682Z","agent":{"ephemeral_id":"4943a2dd-eef2-412c-b496-8cc639fd9bc1","id":"8291ec57-310c-4e62-b5bc-e9ba4ac93b35","name":"03SDPBSVR03","type":"winlogbeat","version":"8.1.3"},"ecs":{"version":"8.0.0"},"event":{"action":"Special Logon","code":"4672","created":"2022-08-10T14:02:20.292Z","kind":"event","outcome":"success","provider":"Microsoft-Windows-Security-Auditing"},"host":{"name":"03SDPBSVR03.SDPB.LOCAL"},"log":{"level":"information"},"message":"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-4204541585-151547883-1297828959-6772\n\tAccount Name:\t\tnighthawk\n\tAccount Domain:\t\tSDPB\n\tLogon ID:\t\t0x1CCBDA62\n\nPrivileges:\t\tSeSecurityPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\n\t\t\tSeEnableDelegationPrivilege","organization":"CalPrivate (oscorp.oscorpcloud.com)","senderHost":"10.87.1.30","sensitivity":"normal","winlog":{"api":"wineventlog","channel":"Security","computer_name":"03SDPBSVR03.SDPB.LOCAL","event_data":{"PrivilegeList":"SeSecurityPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\n\t\t\tSeEnableDelegationPrivilege","SubjectDomainName":"SDPB","SubjectLogonId":"0x1ccbda62","SubjectUserName":"nighthawk","SubjectUserSid":"S-1-5-21-4204541585-151547883-1297828959-6772"},"event_id":"4672","keywords":["Audit Success"],"opcode":"Info","process":{"pid":732,"thread":{"id":2120}},"provider_guid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","provider_name":"Microsoft-Windows-Security-Auditing","record_id":4185315668,"task":"Special Logon"}}
This is a syslog message from a product called Windows Active Directory by Microsoft. The following fields were extracted from the message:
senderhost: 10.87.1.30
severitylabel: Info
tags: ['v8', 'eventId:4672', 'microsoft-windows-security-auditing', 'security_privilege_change']
productids: [43]
sourceinfo: unknown
sensitivity: normal
messagetype: security_privilege_change
vendorcode: 4185315668
action: Special Logon
streamName: microsoft-windows-security-auditing
userName: nighthawk