WitFoo-WinLogBeat ::: {"@metadata":{"beat":"winlogbeat","type":"_doc","version":"8.2.2"},"@timestamp":"2022-09-30T10:29:02.060Z","agent":{"ephemeral_id":"36976287-4fe3-40b9-a82f-3692c2392d77","id":"6846763b-21b7-49f0-ab99-104d7b3b0a78","name":"ADAudit1","type":"winlogbeat","version":"8.2.2"},"ecs":{"version":"8.0.0"},"event":{"action":"Special Logon","code":"4672","created":"2022-09-30T10:29:03.649Z","kind":"event","outcome":"success","provider":"Microsoft-Windows-Security-Auditing"},"host":{"name":"ADAudit1.oscorp.org"},"log":{"level":"information"},"message":"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tjohndoe\n\tAccount Domain:\t\tOSCORP\n\tLogon ID:\t\t0xA8AA552\n\nPrivileges:\t\tSeSecurityPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","organization":"OSCORP (oscorp.oscorpcloud.com)","senderHost":"ADAudit1.oscorp.org","sensitivity":"normal","winlog":{"activity_id":"{2692d4fa-34c2-4626-bb80-c9fc33265209}","api":"wineventlog","channel":"Security","computer_name":"ADAudit1.oscorp.org","event_data":{"PrivilegeList":"SeSecurityPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","SubjectDomainName":"OSCORP","SubjectLogonId":"0xa8aa552","SubjectUserName":"johndoe","SubjectUserSid":"S-1-5-18"},"event_id":"4672","keywords":["Audit Success"],"opcode":"Info","process":{"pid":712,"thread":{"id":756}},"provider_guid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","provider_name":"Microsoft-Windows-Security-Auditing","record_id":5016542,"task":"Special Logon"}}
This is a syslog message from a product called Windows Active Directory by Microsoft. The following fields were extracted from the message:
senderhost: ADAudit1.uwca.org
severitylabel: Info
tags: ['v8', 'eventId:4672', 'microsoft-windows-security-auditing', 'security_privilege_change']
productids: [43]
sourceinfo: unknown
sensitivity: normal
messagetype: security_privilege_change
vendorcode: 5016542
action: Special Logon
streamName: microsoft-windows-security-auditing
userName: johndoe