WitFoo-WinLogBeat ::: {"@metadata":{"beat":"winlogbeat","type":"_doc","version":"8.2.2"},"@timestamp":"2022-08-01T06:48:34.046Z","agent":{"ephemeral_id":"4853e543-6cb1-4d27-a0b5-92904a51b634","id":"76eb9f91-c210-4b95-9288-5a2c5f4e1a67","name":"MicroixWeb01","type":"winlogbeat","version":"8.2.2"},"ecs":{"version":"8.0.0"},"event":{"action":"Special Logon","code":"4672","created":"2022-08-01T06:48:35.965Z","kind":"event","outcome":"success","provider":"Microsoft-Windows-Security-Auditing"},"host":{"name":"MicroixWeb01"},"log":{"level":"information"},"message":"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tcharlie\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","organization":"UMBRELLA (umbrella.umbrellacloud.com)","senderHost":"10.0.0.75","sensitivity":"normal","winlog":{"activity_id":"{3ba13ced-8a12-4020-a436-303e42e3b167}","api":"wineventlog","channel":"Security","computer_name":"MicroixWeb01","event_data":{"PrivilegeList":"SeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","SubjectUserName":"charlie","SubjectUserSid":"S-1-5-18"},"event_id":"4672","keywords":["Audit Success"],"opcode":"Info","process":{"pid":708,"thread":{"id":5692}},"provider_guid":"{54849625-5478-4994-a5ba-3e3b0328c30d}","provider_name":"Microsoft-Windows-Security-Auditing","record_id":1186903,"task":"Special Logon"}}
{
    "senderhost": "10.0.0.75",
    "severitylabel": "Info",
    "tags": [
        "v8",
        "eventId:4672",
        "microsoft-windows-security-auditing",
        "security_privilege_change"
    ],
    "productids": [
        43
    ],
    "sourceinfo": "unknown",
    "message": "WitFoo-WinLogBeat ::: {\"@metadata\":{\"beat\":\"winlogbeat\",\"type\":\"_doc\",\"version\":\"8.2.2\"},\"@timestamp\":\"2022-08-01T06:48:34.046Z\",\"agent\":{\"ephemeral_id\":\"4853e543-6cb1-4d27-a0b5-92904a51b634\",\"id\":\"76eb9f91-c210-4b95-9288-5a2c5f4e1a67\",\"name\":\"MicroixWeb01\",\"type\":\"winlogbeat\",\"version\":\"8.2.2\"},\"ecs\":{\"version\":\"8.0.0\"},\"event\":{\"action\":\"Special Logon\",\"code\":\"4672\",\"created\":\"2022-08-01T06:48:35.965Z\",\"kind\":\"event\",\"outcome\":\"success\",\"provider\":\"Microsoft-Windows-Security-Auditing\"},\"host\":{\"name\":\"MicroixWeb01\"},\"log\":{\"level\":\"information\"},\"message\":\"Special privileges assigned to new logon.\\n\\nSubject:\\n\\tSecurity ID:\\t\\tS-1-5-18\\n\\tAccount Name:\\t\\tcharlie\\n\\tAccount Domain:\\t\\tNT AUTHORITY\\n\\tLogon ID:\\t\\t0x3E7\\n\\nPrivileges:\\t\\tSeAssignPrimaryTokenPrivilege\\n\\t\\t\\tSeTcbPrivilege\\n\\t\\t\\tSeSecurityPrivilege\\n\\t\\t\\tSeTakeOwnershipPrivilege\\n\\t\\t\\tSeLoadDriverPrivilege\\n\\t\\t\\tSeBackupPrivilege\\n\\t\\t\\tSeRestorePrivilege\\n\\t\\t\\tSeDebugPrivilege\\n\\t\\t\\tSeAuditPrivilege\\n\\t\\t\\tSeSystemEnvironmentPrivilege\\n\\t\\t\\tSeImpersonatePrivilege\\n\\t\\t\\tSeDelegateSessionUserImpersonatePrivilege\",\"organization\":\"UMBRELLA (umbrella.umbrellacloud.com)\",\"senderHost\":\"10.0.0.75\",\"sensitivity\":\"normal\",\"winlog\":{\"activity_id\":\"{3ba13ced-8a12-4020-a436-303e42e3b167}\",\"api\":\"wineventlog\",\"channel\":\"Security\",\"computer_name\":\"MicroixWeb01\",\"event_data\":{\"PrivilegeList\":\"SeAssignPrimaryTokenPrivilege\\n\\t\\t\\tSeTcbPrivilege\\n\\t\\t\\tSeSecurityPrivilege\\n\\t\\t\\tSeTakeOwnershipPrivilege\\n\\t\\t\\tSeLoadDriverPrivilege\\n\\t\\t\\tSeBackupPrivilege\\n\\t\\t\\tSeRestorePrivilege\\n\\t\\t\\tSeDebugPrivilege\\n\\t\\t\\tSeAuditPrivilege\\n\\t\\t\\tSeSystemEnvironmentPrivilege\\n\\t\\t\\tSeImpersonatePrivilege\\n\\t\\t\\tSeDelegateSessionUserImpersonatePrivilege\",\"SubjectDomainName\":\"NT AUTHORITY\",\"SubjectLogonId\":\"0x3e7\",\"SubjectUserName\":\"charlie\",\"SubjectUserSid\":\"S-1-5-18\"},\"event_id\":\"4672\",\"keywords\":[\"Audit Success\"],\"opcode\":\"Info\",\"process\":{\"pid\":708,\"thread\":{\"id\":5692}},\"provider_guid\":\"{54849625-5478-4994-a5ba-3e3b0328c30d}\",\"provider_name\":\"Microsoft-Windows-Security-Auditing\",\"record_id\":1186903,\"task\":\"Special Logon\"}}",
    "sensitivity": "normal",
    "messagetype": "security_privilege_change",
    "vendorcode": "1186903",
    "action": "Special Logon",
    "streamName": "microsoft-windows-security-auditing",
    "userName": "charlie"
}