<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4662</EventID><Version>0</Version><Level>0</Level><Task>14080</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2024-07-26T18:55:03.490771100Z'/><EventRecordID>48442374</EventRecordID><Correlation/><Execution ProcessID='656' ThreadID='788'/><Channel>Security</Channel><Computer>IP-C61301BB.prdnca.acmeint.com</Computer><Security/></System><EventData><Data Name='SubjectUserSid'>S-1-5-21-1039153840-3272993233-2871880688-95610</Data><Data Name='SubjectUserName'>IP-C61302E6$</Data><Data Name='SubjectDomainName'>prdnca</Data><Data Name='SubjectLogonId'>0x3c642a77</Data><Data Name='ObjectServer'>DS</Data><Data Name='ObjectType'>%{19195a5b-6da0-11d0-afd3-00c04fd930c9}</Data><Data Name='ObjectName'>%{8f693d50-1a73-4ef1-8499-25fa1c60205e}</Data><Data Name='OperationType'>Object Access</Data><Data Name='HandleId'>0x0</Data><Data Name='AccessList'>%%7688
				</Data><Data Name='AccessMask'>0x100</Data><Data Name='Properties'>%%7688
		{89e95b76-444d-4c62-991a-0facbeda640c}
	{19195a5b-6da0-11d0-afd3-00c04fd930c9}
</Data><Data Name='AdditionalInfo'>-</Data><Data Name='AdditionalInfo2'></Data></EventData><RenderingInfo Culture='en-US'><Message>An operation was performed on an object.

Subject :
	Security ID:		S-1-5-21-1039153840-3272993233-2871880688-95610
	Account Name:		IP-C61302E6$
	Account Domain:		prdnca
	Logon ID:		0x3C642A77

Object:
	Object Server:		DS
	Object Type:		%{19195a5b-6da0-11d0-afd3-00c04fd930c9}
	Object Name:		%{8f693d50-1a73-4ef1-8499-25fa1c60205e}
	Handle ID:		0x0

Operation:
	Operation Type:		Object Access
	Accesses:		Control Access
				
	Access Mask:		0x100
	Properties:		Control Access
		{89e95b76-444d-4c62-991a-0facbeda640c}
	{19195a5b-6da0-11d0-afd3-00c04fd930c9}


Additional Information:
	Parameter 1:		-
	Parameter 2:		</Message><Level>Information</Level><Task>Directory Service Access</Task><Opcode>Info</Opcode><Channel>Security</Channel><Provider>Microsoft Windows security auditing.</Provider><Keywords><Keyword>Audit Success</Keyword></Keywords></RenderingInfo></Event>
{
    "fieldExtractorName": "windows_security_audit_xml",
    "message": "<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4662</EventID><Version>0</Version><Level>0</Level><Task>14080</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2024-07-26T18:55:03.490771100Z'/><EventRecordID>48442374</EventRecordID><Correlation/><Execution ProcessID='656' ThreadID='788'/><Channel>Security</Channel><Computer>IP-C61301BB.prdnca.acmeint.com</Computer><Security/></System><EventData><Data Name='SubjectUserSid'>S-1-5-21-1039153840-3272993233-2871880688-95610</Data><Data Name='SubjectUserName'>IP-C61302E6$</Data><Data Name='SubjectDomainName'>prdnca</Data><Data Name='SubjectLogonId'>0x3c642a77</Data><Data Name='ObjectServer'>DS</Data><Data Name='ObjectType'>%{19195a5b-6da0-11d0-afd3-00c04fd930c9}</Data><Data Name='ObjectName'>%{8f693d50-1a73-4ef1-8499-25fa1c60205e}</Data><Data Name='OperationType'>Object Access</Data><Data Name='HandleId'>0x0</Data><Data Name='AccessList'>%%7688\r\n\t\t\t\t</Data><Data Name='AccessMask'>0x100</Data><Data Name='Properties'>%%7688\r\n\t\t{89e95b76-444d-4c62-991a-0facbeda640c}\r\n\t{19195a5b-6da0-11d0-afd3-00c04fd930c9}\r\n</Data><Data Name='AdditionalInfo'>-</Data><Data Name='AdditionalInfo2'></Data></EventData><RenderingInfo Culture='en-US'><Message>An operation was performed on an object.\r\n\r\nSubject :\r\n\tSecurity ID:\t\tS-1-5-21-1039153840-3272993233-2871880688-95610\r\n\tAccount Name:\t\tIP-C61302E6$\r\n\tAccount Domain:\t\tprdnca\r\n\tLogon ID:\t\t0x3C642A77\r\n\r\nObject:\r\n\tObject Server:\t\tDS\r\n\tObject Type:\t\t%{19195a5b-6da0-11d0-afd3-00c04fd930c9}\r\n\tObject Name:\t\t%{8f693d50-1a73-4ef1-8499-25fa1c60205e}\r\n\tHandle ID:\t\t0x0\r\n\r\nOperation:\r\n\tOperation Type:\t\tObject Access\r\n\tAccesses:\t\tControl Access\r\n\t\t\t\t\r\n\tAccess Mask:\t\t0x100\r\n\tProperties:\t\tControl Access\r\n\t\t{89e95b76-444d-4c62-991a-0facbeda640c}\r\n\t{19195a5b-6da0-11d0-afd3-00c04fd930c9}\r\n\r\n\r\nAdditional Information:\r\n\tParameter 1:\t\t-\r\n\tParameter 2:\t\t</Message><Level>Information</Level><Task>Directory Service Access</Task><Opcode>Info</Opcode><Channel>Security</Channel><Provider>Microsoft Windows security auditing.</Provider><Keywords><Keyword>Audit Success</Keyword></Keywords></RenderingInfo></Event>",
    "messageType": "security_audit_event",
    "senderHost": "10.168.2.6-SecurityEvents",
    "sensitivity": "normal",
    "serverHostname": "IP-C61301BB.prdnca.paygoint.com",
    "sourceInfo": "unknown",
    "streamName": "windows_security_audit",
    "tags": [
        "eventId:4662",
        "windows_security_audit",
        "security_audit_event"
    ]
}