WitFoo-WinLogBeat ::: {"@metadata":{"beat":"winlogbeat","type":"_doc","version":"8.2.2"},"@timestamp":"2024-07-30T10:14:40.387Z","agent":{"ephemeral_id":"a668c636-ec70-4103-9c98-53517f0df854","id":"040c78f0-1741-4108-a30c-aaf00e9af961","name":"NVIPROCPRDWEB01","type":"winlogbeat","version":"8.2.2"},"ecs":{"version":"8.0.0"},"event":{"action":"Logon","code":"4648","created":"2024-07-30T10:14:42.297Z","kind":"event","outcome":"success","provider":"Microsoft-Windows-Security-Auditing"},"host":{"name":"NVIPROCPRDWEB01.prdnvi.umbrellaint.com"},"log":{"level":"information"},"message":"A logon was attempted using explicit credentials.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tNVIPROCPRDWEB01$\n\tAccount Domain:\t\tprdnvi\n\tLogon ID:\t\t0x3E7\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nAccount Whose Credentials Were Used:\n\tAccount Name:\t\tprocprd-appuser\n\tAccount Domain:\t\tprdnvi\n\tLogon GUID:\t\t{cbf3a394-d4ce-9622-1544-923035733fe4}\n\nTarget Server:\n\tTarget Server Name:\tlocalhost\n\tAdditional Information:\tlocalhost\n\nProcess Information:\n\tProcess ID:\t\t0xb08\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nNetwork Information:\n\tNetwork Address:\t-\n\tPort:\t\t\t-\n\nThis event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.","organization":"umbrella","senderHost":"10.160.18.44","sensitivity":"normal","winlog":{"activity_id":"{72e70134-d9a9-0000-db01-e772a9d9da01}","api":"wineventlog","channel":"Security","computer_name":"NVIPROCPRDWEB01.prdnvi.umbrellaint.com","event_data":{"IpAddress":"-","IpPort":"-","LogonGuid":"{00000000-0000-0000-0000-000000000000}","ProcessId":"0xb08","ProcessName":"C:\\Windows\\System32\\svchost.exe","SubjectDomainName":"prdnvi","SubjectLogonId":"0x3e7","SubjectUserName":"NVIPROCPRDWEB01$","SubjectUserSid":"S-1-5-18","TargetDomainName":"prdnvi","TargetInfo":"localhost","TargetLogonGuid":"{cbf3a394-d4ce-9622-1544-923035733fe4}","TargetServerName":"localhost","TargetUserName":"procprd-appuser"},"event_id":"4648","keywords":["Audit Success"],"opcode":"Info","process":{"pid":652,"thread":{"id":1116}},"provider_guid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","provider_name":"Microsoft-Windows-Security-Auditing","record_id":6493970,"task":"Logon"}}
{
    "fieldExtractorName": "symantec_dlp",
    "message": "WitFoo-WinLogBeat ::: {\"@metadata\":{\"beat\":\"winlogbeat\",\"type\":\"_doc\",\"version\":\"8.2.2\"},\"@timestamp\":\"2024-07-30T10:14:40.387Z\",\"agent\":{\"ephemeral_id\":\"a668c636-ec70-4103-9c98-53517f0df854\",\"id\":\"040c78f0-1741-4108-a30c-aaf00e9af961\",\"name\":\"NVIPROCPRDWEB01\",\"type\":\"winlogbeat\",\"version\":\"8.2.2\"},\"ecs\":{\"version\":\"8.0.0\"},\"event\":{\"action\":\"Logon\",\"code\":\"4648\",\"created\":\"2024-07-30T10:14:42.297Z\",\"kind\":\"event\",\"outcome\":\"success\",\"provider\":\"Microsoft-Windows-Security-Auditing\"},\"host\":{\"name\":\"NVIPROCPRDWEB01.prdnvi.umbrellaint.com\"},\"log\":{\"level\":\"information\"},\"message\":\"A logon was attempted using explicit credentials.\\n\\nSubject:\\n\\tSecurity ID:\\t\\tS-1-5-18\\n\\tAccount Name:\\t\\tNVIPROCPRDWEB01$\\n\\tAccount Domain:\\t\\tprdnvi\\n\\tLogon ID:\\t\\t0x3E7\\n\\tLogon GUID:\\t\\t{00000000-0000-0000-0000-000000000000}\\n\\nAccount Whose Credentials Were Used:\\n\\tAccount Name:\\t\\tprocprd-appuser\\n\\tAccount Domain:\\t\\tprdnvi\\n\\tLogon GUID:\\t\\t{cbf3a394-d4ce-9622-1544-923035733fe4}\\n\\nTarget Server:\\n\\tTarget Server Name:\\tlocalhost\\n\\tAdditional Information:\\tlocalhost\\n\\nProcess Information:\\n\\tProcess ID:\\t\\t0xb08\\n\\tProcess Name:\\t\\tC:\\\\Windows\\\\System32\\\\svchost.exe\\n\\nNetwork Information:\\n\\tNetwork Address:\\t-\\n\\tPort:\\t\\t\\t-\\n\\nThis event is generated when a process attempts to log on an account by explicitly specifying that account\u2019s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.\",\"organization\":\"umbrella\",\"senderHost\":\"10.160.18.44\",\"sensitivity\":\"normal\",\"winlog\":{\"activity_id\":\"{72e70134-d9a9-0000-db01-e772a9d9da01}\",\"api\":\"wineventlog\",\"channel\":\"Security\",\"computer_name\":\"NVIPROCPRDWEB01.prdnvi.umbrellaint.com\",\"event_data\":{\"IpAddress\":\"-\",\"IpPort\":\"-\",\"LogonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"ProcessId\":\"0xb08\",\"ProcessName\":\"C:\\\\Windows\\\\System32\\\\svchost.exe\",\"SubjectDomainName\":\"prdnvi\",\"SubjectLogonId\":\"0x3e7\",\"SubjectUserName\":\"NVIPROCPRDWEB01$\",\"SubjectUserSid\":\"S-1-5-18\",\"TargetDomainName\":\"prdnvi\",\"TargetInfo\":\"localhost\",\"TargetLogonGuid\":\"{cbf3a394-d4ce-9622-1544-923035733fe4}\",\"TargetServerName\":\"localhost\",\"TargetUserName\":\"procprd-appuser\"},\"event_id\":\"4648\",\"keywords\":[\"Audit Success\"],\"opcode\":\"Info\",\"process\":{\"pid\":652,\"thread\":{\"id\":1116}},\"provider_guid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"provider_name\":\"Microsoft-Windows-Security-Auditing\",\"record_id\":6493970,\"task\":\"Logon\"}}",
    "messageType": "data_loss",
    "productIds": [
        44
    ],
    "senderHost": "10.160.18.44",
    "sensitivity": "normal",
    "sourceInfo": "unknown",
    "streamName": "symantec_dlp",
    "tags": [
        "symantec_dlp",
        "data_loss"
    ]
}