WitFoo-WinLogBeat ::: {"@metadata":{"beat":"winlogbeat","type":"_doc","version":"8.1.3"},"@timestamp":"2022-08-10T14:02:19.639Z","agent":{"ephemeral_id":"4943a2dd-eef2-412c-b496-8cc639fd9bc1","id":"8291ec57-310c-4e62-b5bc-e9ba4ac93b35","name":"03SDPBSVR03","type":"winlogbeat","version":"8.1.3"},"ecs":{"version":"8.0.0"},"event":{"action":"Special Logon","code":"4672","created":"2022-08-10T14:02:20.292Z","kind":"event","outcome":"success","provider":"Microsoft-Windows-Security-Auditing"},"host":{"name":"03SDPBSVR03.SDPB.LOCAL"},"log":{"level":"information"},"message":"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-4204541585-151547883-1297828959-6772\n\tAccount Name:\t\talice\n\tAccount Domain:\t\tSDPB\n\tLogon ID:\t\t0x1CCBD9EE\n\nPrivileges:\t\tSeSecurityPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\n\t\t\tSeEnableDelegationPrivilege","organization":"CalPrivate (acme.acmecloud.com)","senderHost":"10.87.1.30","sensitivity":"normal","winlog":{"activity_id":"{8E66BBBD-AC7B-0000-E0BB-668E7BACD801}","api":"wineventlog","channel":"Security","computer_name":"03SDPBSVR03.SDPB.LOCAL","event_data":{"PrivilegeList":"SeSecurityPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\n\t\t\tSeEnableDelegationPrivilege","SubjectDomainName":"SDPB","SubjectLogonId":"0x1ccbd9ee","SubjectUserName":"alice","SubjectUserSid":"S-1-5-21-4204541585-151547883-1297828959-6772"},"event_id":"4672","keywords":["Audit Success"],"opcode":"Info","process":{"pid":732,"thread":{"id":4240}},"provider_guid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","provider_name":"Microsoft-Windows-Security-Auditing","record_id":4185315658,"task":"Special Logon"}}
{
    "senderhost": "10.87.1.30",
    "severitylabel": "Info",
    "tags": [
        "v8",
        "eventId:4672",
        "microsoft-windows-security-auditing",
        "security_privilege_change"
    ],
    "productids": [
        43
    ],
    "sourceinfo": "unknown",
    "message": "WitFoo-WinLogBeat ::: {\"@metadata\":{\"beat\":\"winlogbeat\",\"type\":\"_doc\",\"version\":\"8.1.3\"},\"@timestamp\":\"2022-08-10T14:02:19.639Z\",\"agent\":{\"ephemeral_id\":\"4943a2dd-eef2-412c-b496-8cc639fd9bc1\",\"id\":\"8291ec57-310c-4e62-b5bc-e9ba4ac93b35\",\"name\":\"03SDPBSVR03\",\"type\":\"winlogbeat\",\"version\":\"8.1.3\"},\"ecs\":{\"version\":\"8.0.0\"},\"event\":{\"action\":\"Special Logon\",\"code\":\"4672\",\"created\":\"2022-08-10T14:02:20.292Z\",\"kind\":\"event\",\"outcome\":\"success\",\"provider\":\"Microsoft-Windows-Security-Auditing\"},\"host\":{\"name\":\"03SDPBSVR03.SDPB.LOCAL\"},\"log\":{\"level\":\"information\"},\"message\":\"Special privileges assigned to new logon.\\n\\nSubject:\\n\\tSecurity ID:\\t\\tS-1-5-21-4204541585-151547883-1297828959-6772\\n\\tAccount Name:\\t\\talice\\n\\tAccount Domain:\\t\\tSDPB\\n\\tLogon ID:\\t\\t0x1CCBD9EE\\n\\nPrivileges:\\t\\tSeSecurityPrivilege\\n\\t\\t\\tSeBackupPrivilege\\n\\t\\t\\tSeRestorePrivilege\\n\\t\\t\\tSeTakeOwnershipPrivilege\\n\\t\\t\\tSeDebugPrivilege\\n\\t\\t\\tSeSystemEnvironmentPrivilege\\n\\t\\t\\tSeLoadDriverPrivilege\\n\\t\\t\\tSeImpersonatePrivilege\\n\\t\\t\\tSeDelegateSessionUserImpersonatePrivilege\\n\\t\\t\\tSeEnableDelegationPrivilege\",\"organization\":\"CalPrivate (acme.acmecloud.com)\",\"senderHost\":\"10.87.1.30\",\"sensitivity\":\"normal\",\"winlog\":{\"activity_id\":\"{8E66BBBD-AC7B-0000-E0BB-668E7BACD801}\",\"api\":\"wineventlog\",\"channel\":\"Security\",\"computer_name\":\"03SDPBSVR03.SDPB.LOCAL\",\"event_data\":{\"PrivilegeList\":\"SeSecurityPrivilege\\n\\t\\t\\tSeBackupPrivilege\\n\\t\\t\\tSeRestorePrivilege\\n\\t\\t\\tSeTakeOwnershipPrivilege\\n\\t\\t\\tSeDebugPrivilege\\n\\t\\t\\tSeSystemEnvironmentPrivilege\\n\\t\\t\\tSeLoadDriverPrivilege\\n\\t\\t\\tSeImpersonatePrivilege\\n\\t\\t\\tSeDelegateSessionUserImpersonatePrivilege\\n\\t\\t\\tSeEnableDelegationPrivilege\",\"SubjectDomainName\":\"SDPB\",\"SubjectLogonId\":\"0x1ccbd9ee\",\"SubjectUserName\":\"alice\",\"SubjectUserSid\":\"S-1-5-21-4204541585-151547883-1297828959-6772\"},\"event_id\":\"4672\",\"keywords\":[\"Audit Success\"],\"opcode\":\"Info\",\"process\":{\"pid\":732,\"thread\":{\"id\":4240}},\"provider_guid\":\"{54849625-5478-4994-A5BA-3E3B0328C30D}\",\"provider_name\":\"Microsoft-Windows-Security-Auditing\",\"record_id\":4185315658,\"task\":\"Special Logon\"}}",
    "sensitivity": "normal",
    "messagetype": "security_privilege_change",
    "vendorcode": "4185315658",
    "action": "Special Logon",
    "streamName": "microsoft-windows-security-auditing",
    "userName": "alice"
}