From 952239867e8b7f0c6f303cfafb19c3b15db52486 Mon Sep 17 00:00:00 2001 From: Anabella Cristaldi Date: Wed, 19 Aug 2020 12:00:37 +0200 Subject: [PATCH 1/5] Audit and Authentication Policy Change Events --- .../security/config/winlogbeat-security.js | 519 +++++++++++++++++- .../test/testdata/4670_WindowsSrv2016.evtx | Bin 0 -> 69632 bytes .../test/testdata/4706_WindowsSrv2016.evtx | Bin 0 -> 69632 bytes .../test/testdata/4707_WindowsSrv2016.evtx | Bin 0 -> 69632 bytes .../test/testdata/4713_WindowsSrv2016.evtx | Bin 0 -> 69632 bytes .../test/testdata/4716_WindowsSrv2016.evtx | Bin 0 -> 69632 bytes .../test/testdata/4717_WindowsSrv2016.evtx | Bin 0 -> 69632 bytes .../test/testdata/4718_WindowsSrv2016.evtx | Bin 0 -> 69632 bytes .../test/testdata/4719_WindowsSrv2016.evtx | Bin 0 -> 69632 bytes .../test/testdata/4739_WindowsSrv2016.evtx | Bin 0 -> 69632 bytes .../test/testdata/4817_WindowsSrv2016.evtx | Bin 0 -> 69632 bytes .../test/testdata/4902_WindowsSrv2016.evtx | Bin 0 -> 69632 bytes .../test/testdata/4904_WindowsSrv2016.evtx | Bin 0 -> 69632 bytes .../test/testdata/4905_WindowsSrv2016.evtx | Bin 0 -> 69632 bytes .../test/testdata/4906_WindowsSrv2016.evtx | Bin 0 -> 69632 bytes .../test/testdata/4907_WindowsSrv2016.evtx | Bin 0 -> 69632 bytes .../test/testdata/4908_WindowsSrv2016.evtx | Bin 0 -> 69632 bytes .../test/testdata/4912_WindowsSrv2016.evtx | Bin 0 -> 69632 bytes 18 files changed, 506 insertions(+), 13 deletions(-) create mode 100644 x-pack/winlogbeat/module/security/test/testdata/4670_WindowsSrv2016.evtx create mode 100644 x-pack/winlogbeat/module/security/test/testdata/4706_WindowsSrv2016.evtx create mode 100644 x-pack/winlogbeat/module/security/test/testdata/4707_WindowsSrv2016.evtx create mode 100644 x-pack/winlogbeat/module/security/test/testdata/4713_WindowsSrv2016.evtx create mode 100644 x-pack/winlogbeat/module/security/test/testdata/4716_WindowsSrv2016.evtx create mode 100644 x-pack/winlogbeat/module/security/test/testdata/4717_WindowsSrv2016.evtx create mode 100644 x-pack/winlogbeat/module/security/test/testdata/4718_WindowsSrv2016.evtx create mode 100644 x-pack/winlogbeat/module/security/test/testdata/4719_WindowsSrv2016.evtx create mode 100644 x-pack/winlogbeat/module/security/test/testdata/4739_WindowsSrv2016.evtx create mode 100644 x-pack/winlogbeat/module/security/test/testdata/4817_WindowsSrv2016.evtx create mode 100644 x-pack/winlogbeat/module/security/test/testdata/4902_WindowsSrv2016.evtx create mode 100644 x-pack/winlogbeat/module/security/test/testdata/4904_WindowsSrv2016.evtx create mode 100644 x-pack/winlogbeat/module/security/test/testdata/4905_WindowsSrv2016.evtx create mode 100644 x-pack/winlogbeat/module/security/test/testdata/4906_WindowsSrv2016.evtx create mode 100644 x-pack/winlogbeat/module/security/test/testdata/4907_WindowsSrv2016.evtx create mode 100644 x-pack/winlogbeat/module/security/test/testdata/4908_WindowsSrv2016.evtx create mode 100644 x-pack/winlogbeat/module/security/test/testdata/4912_WindowsSrv2016.evtx diff --git a/x-pack/winlogbeat/module/security/config/winlogbeat-security.js b/x-pack/winlogbeat/module/security/config/winlogbeat-security.js index 56cdced6b51..4895ba807e6 100644 --- a/x-pack/winlogbeat/module/security/config/winlogbeat-security.js +++ b/x-pack/winlogbeat/module/security/config/winlogbeat-security.js @@ -180,6 +180,7 @@ var security = (function () { "4647": [["authentication"], ["end"], "logged-out"], "4648": [["authentication"], ["start"], "logged-in-explicit"], "4657": [["configuration"], ["change"], "registry-value-modified"], + "4670": [["iam", "configuration"],["admin", "change"],"permissions-changed"], "4672": [["iam"], ["admin"], "logged-in-special"], "4673": [["iam"], ["admin"], "privileged-service-called"], "4674": [["iam"], ["admin"], "privileged-operation"], @@ -197,6 +198,8 @@ var security = (function () { "4714": [["configuration"], ["change"], "encrypted-data-recovery-policy-changed"], "4715": [["configuration"], ["change"], "object-audit-policy-changed"], "4716": [["configuration"], ["change"], "trusted-domain-information-changed"], + "4717": [["iam", "configuration"],["admin", "change"],"system-security-access-granted"], + "4718": [["iam", "configuration"],["admin", "deletion"],"system-security-access-removed"], "4719": [["iam", "configuration"], ["admin", "change"], "changed-audit-config"], // remove iam and admin "4720": [["iam"], ["user", "creation"], "added-user-account"], "4722": [["iam"], ["user", "change"], "enabled-user-account"], @@ -252,7 +255,14 @@ var security = (function () { "4781": [["iam"], ["user", "change"], "renamed-user-account"], "4798": [["iam"], ["user", "info"], "group-membership-enumerated"], // process enumerates the local groups to which the specified user belongs "4799": [["iam"], ["group", "info"], "user-member-enumerated"], // a process enumerates the members of the specified local group - "4912": [["configuration"], ["change"], "per-user-audit-policy-changed"], + "4817": [["iam", "configuration"], ["admin", "change"],"object-audit-changed"], + "4902": [["iam", "configuration"], ["admin", "creation"],"user-audit-policy-created"], + "4904": [["iam", "configuration"], ["admin", "change"],"security-event-source-added"], + "4905": [["iam", "configuration"], ["admin", "deletion"], "security-event-source-removed"], + "4906": [["iam", "configuration"], ["admin", "change"], "crash-on-audit-changed"], + "4907": [["iam", "configuration"], ["admin", "change"], "audit-setting-changed"], + "4908": [["iam", "configuration"], ["admin", "change"], "special-group-table-changed"], + "4912": [["iam", "configuration"], ["admin", "change"], "per-user-audit-policy-changed"], "4950": [["configuration"], ["change"], "windows-firewall-setting-changed"], "4954": [["configuration"], ["change"], "windows-firewall-group-policy-changed"], "4964": [["iam"], ["admin", "group"], "logged-in-special"], @@ -263,16 +273,6 @@ var security = (function () { "5037": [["driver"], ["end"], "windows-firewall-driver-error"], }; - - // Audit Policy Changes Table - // https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4719 - var auditActions = { - "8448": "Success Removed", - "8450": "Failure Removed", - "8449": "Success Added", - "8451": "Failure Added", - }; - // Services Types // https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4697 var serviceTypes = { @@ -1351,6 +1351,250 @@ var security = (function () { "16903": "Publish", }; + // Trust Types + // https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4706 + var trustTypes = { + "1": "TRUST_TYPE_DOWNLEVEL", + "2": "TRUST_TYPE_UPLEVEL", + "3": "TRUST_TYPE_MIT", + "4": "TRUST_TYPE_DCE" + } + + // Trust Direction + // https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4706 + var trustDirection = { + "0": "TRUST_DIRECTION_DISABLED", + "1": "TRUST_DIRECTION_INBOUND", + "2": "TRUST_DIRECTION_OUTBOUND", + "3": "TRUST_DIRECTION_BIDIRECTIONAL" + } + + // Trust Attributes + // https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4706 + var trustAttributes = { + "0": "UNDEFINED", + "1": "TRUST_ATTRIBUTE_NON_TRANSITIVE", + "2": "TRUST_ATTRIBUTE_UPLEVEL_ONLY", + "4": "TRUST_ATTRIBUTE_QUARANTINED_DOMAIN", + "8": "TRUST_ATTRIBUTE_FOREST_TRANSITIVE", + "16": "TRUST_ATTRIBUTE_CROSS_ORGANIZATION", + "32": "TRUST_ATTRIBUTE_WITHIN_FOREST", + "64": "TRUST_ATTRIBUTE_TREAT_AS_EXTERNAL", + "128": "TRUST_ATTRIBUTE_USES_RC4_ENCRYPTION", + "512": "TRUST_ATTRIBUTE_CROSS_ORGANIZATION_NO_TGT_DELEGATION", + "1024": "TRUST_ATTRIBUTE_PIM_TRUST" + } + + // SDDL Ace Types + // https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4715 + // https://docs.microsoft.com/en-us/windows/win32/secauthz/ace-strings + // https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/f4296d69-1c0f-491f-9587-a960b292d070 + var aceTypes = { + "A": "Access Allowed", + "D": "Access Denied", + "OA": "Object Access Allowed", + "OD": "Object Access Denied", + "AU": "System Audit", + "AL": "System Alarm", + "OU": "System Object Audit", + "OL": "System Object Alarm", + "ML": "System Mandatory Label", + "SP": "Central Policy ID" + } + + // SDDL Permissions + // https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4715 + // https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/f4296d69-1c0f-491f-9587-a960b292d070 + var permissionDescription = { + "GA": "Generic All", + "GR": "Generic Read", + "GW": "Generic Write", + "GX": "Generic Execute", + "RC": "Read Permissions", + "SD": "Delete", + "WD": "Modify Permissions", + "WO": "Modify Owner", + "RP": "Read All Properties", + "WP": "Write All Properties", + "CC": "Create All Child Objects", + "DC": "Delete All Child Objects", + "LC": "List Contents", + "SW": "All Validated", + "LO": "List Object", + "DT": "Delete Subtree", + "CR": "All Extended Rights", + "FA": "File All Access", + "FR": "File Generic Read", + "FX": "FILE GENERIC EXECUTE", + "FW": "FILE GENERIC WRITE", + "KA": "KEY ALL ACCESS", + "KR": "KEY READ", + "KW": "KEY WRITE", + "KX": "KEY EXECUTE" + } + + // Known SIDs + // https://support.microsoft.com/en-au/help/243330/well-known-security-identifier"S-in-window"S-operating-systems + // https://docs.microsoft.com/en-us/windows/win32/secauthz/sid-strings + var accountSIDDescription = { + "AO": "Account operators", + "RU": "Alias to allow previous Windows 2000", + "AN": "Anonymous logon", + "AU": "Authenticated users", + "BA": "Built-in administrators", + "BG": "Built-in guests", + "BO": "Backup operators", + "BU": "Built-in users", + "CA": "Certificate server administrators", + "CG": "Creator group", + "CO": "Creator owner", + "DA": "Domain administrators", + "DC": "Domain computers", + "DD": "Domain controllers", + "DG": "Domain guests", + "DU": "Domain users", + "EA": "Enterprise administrators", + "ED": "Enterprise domain controllers", + "WD": "Everyone", + "PA": "Group Policy administrators", + "IU": "Interactively logged-on user", + "LA": "Local administrator", + "LG": "Local guest", + "LS": "Local service account", + "SY": "Local system", + "NU": "Network logon user", + "NO": "Network configuration operators", + "NS": "Network service account", + "PO": "Printer operators", + "PS": "Personal self", + "PU": "Power users", + "RS": "RAS servers group", + "RD": "Terminal server users", + "RE": "Replicator", + "RC": "Restricted code", + "SA": "Schema administrators", + "SO": "Server operators", + "SU": "Service logon user", + "S-1-0": "Null Authority", + "S-1-0-0": "Nobody", + "S-1-1": "World Authority", + "S-1-1-0": "Everyone", + "S-1-16-0": "Untrusted Mandatory Level", + "S-1-16-12288": "High Mandatory Level", + "S-1-16-16384": "System Mandatory Level", + "S-1-16-20480": "Protected Process Mandatory Level", + "S-1-16-28672": "Secure Process Mandatory Level", + "S-1-16-4096": "Low Mandatory Level", + "S-1-16-8192": "Medium Mandatory Level", + "S-1-16-8448": "Medium Plus Mandatory Level", + "S-1-2": "Local Authority", + "S-1-2-0": "Local", + "S-1-2-1": "Console Logon", + "S-1-3": "Creator Authority", + "S-1-3-0": "Creator Owner", + "S-1-3-1": "Creator Group", + "S-1-3-2": "Creator Owner Server", + "S-1-3-3": "Creator Group Server", + "S-1-3-4": "Owner Rights", + "S-1-4": "Non-unique Authority", + "S-1-5": "NT Authority", + "S-1-5-1": "Dialup", + "S-1-5-10": "Principal Self", + "S-1-5-11": "Authenticated Users", + "S-1-5-12": "Restricted Code", + "S-1-5-13": "Terminal Server Users", + "S-1-5-14": "Remote Interactive Logon", + "S-1-5-15": "This Organization", + "S-1-5-17": "This Organization", + "S-1-5-18": "Local System", + "S-1-5-19": "NT Authority", + "S-1-5-2": "Network", + "S-1-5-20": "NT Authority", + "S-1-5-3": "Batch", + "S-1-5-32-544": "Administrators", + "S-1-5-32-545": "Users", + "S-1-5-32-546": "Guests", + "S-1-5-32-547": "Power Users", + "S-1-5-32-548": "Account Operators", + "S-1-5-32-549": "Server Operators", + "S-1-5-32-550": "Print Operators", + "S-1-5-32-551": "Backup Operators", + "S-1-5-32-552": "Replicators", + "S-1-5-32-554": "Builtin\Pre-Windows 2000 Compatible Access", + "S-1-5-32-555": "Builtin\Remote Desktop Users", + "S-1-5-32-556": "Builtin\Network Configuration Operators", + "S-1-5-32-557": "Builtin\Incoming Forest Trust Builders", + "S-1-5-32-558": "Builtin\Performance Monitor Users", + "S-1-5-32-559": "Builtin\Performance Log Users", + "S-1-5-32-560": "Builtin\Windows Authorization Access Group", + "S-1-5-32-561": "Builtin\Terminal Server License Servers", + "S-1-5-32-562": "Builtin\Distributed COM Users", + "S-1-5-32-569": "Builtin\Cryptographic Operators", + "S-1-5-32-573": "Builtin\Event Log Readers", + "S-1-5-32-574": "Builtin\Certificate Service DCOM Access", + "S-1-5-32-575": "Builtin\RDS Remote Access Servers", + "S-1-5-32-576": "Builtin\RDS Endpoint Servers", + "S-1-5-32-577": "Builtin\RDS Management Servers", + "S-1-5-32-578": "Builtin\Hyper-V Administrators", + "S-1-5-32-579": "Builtin\Access Control Assistance Operators", + "S-1-5-32-580": "Builtin\Remote Management Users", + "S-1-5-32-582": "Storage Replica Administrators", + "S-1-5-4": "Interactive", + "S-1-5-5-X-Y": "Logon Session", + "S-1-5-6": "Service", + "S-1-5-64-10": "NTLM Authentication", + "S-1-5-64-14": "SChannel Authentication", + "S-1-5-64-21": "Digest Authentication", + "S-1-5-7": "Anonymous", + "S-1-5-8": "Proxy", + "S-1-5-80": "NT Service", + "S-1-5-80-0": "All Services", + "S-1-5-83-0": "NT Virtual Machine\Virtual Machines", + "S-1-5-9": "Enterprise Domain Controllers", + "S-1-5-90-0": "Windows Manager\Windows Manager Group" + } + + // Domain-specific SIDs + // https://support.microsoft.com/en-au/help/243330/well-known-security-identifiers-in-windows-operating-systems + var domainSpecificSID = { + "498": "Enterprise Read-only Domain Controllers", + "500": "Administrator", + "501": "Guest", + "502": "KRBTGT", + "512": "Domain Admins", + "513": "Domain Users", + "514": "Domain Guests", + "515": "Domain Computers", + "516": "Domain Controllers", + "517": "Cert Publishers", + "518": "Schema Admins", + "519": "Enterprise Admins", + "520": "Group Policy Creator Owners", + "521": "Read-only Domain Controllers", + "522": "Cloneable Domain Controllers", + "526": "Key Admins", + "527": "Enterprise Key Admins", + "553": "RAS and IAS Servers", + "571": "Allowed RODC Password Replication Group", + "572": "Denied RODC Password Replication Group" + } + + // Object Permission Flags + // https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/7a53f60e-e730-4dfe-bbe9-b21b62eb790b + var permsFlags = [ + [0x80000000, 'Generic Read'], + [0x4000000, 'Generic Write'], + [0x20000000, 'Generic Execute'], + [0x10000000, 'Generic All'], + [0x02000000, 'Maximun Allowed'], + [0x01000000, 'Access System Security'], + [0x00100000, 'Syncronize'], + [0x00080000, 'Write Owner'], + [0x00040000, 'Write DACL'], + [0x00020000, 'Read Control'], + [0x00010000, 'Delete'] + ]; + // lookupMessageCode returns the string associated with the code. key should // be the name of the field in evt containing the code (e.g. %%2313). var lookupMessageCode = function (evt, key) { @@ -1455,7 +1699,7 @@ var security = (function () { var actionResults = []; for (var j = 0; j < codedActions.length; j++) { var actionCode = codedActions[j].replace("%%", '').replace(' ', ''); - actionResults.push(auditActions[actionCode]); + actionResults.push(msobjsMessageTable[actionCode]); } evt.Put("winlog.event_data.AuditPolicyChangesDescription", actionResults); }; @@ -1495,12 +1739,118 @@ var security = (function () { evt.Put("winlog.event_data.StatusDescription", kerberosTktStatusCodes[code]); }; + var translateSID = function(sid){ + var translatedSID = accountSIDDescription[sid]; + if (translatedSID == undefined) { + if (/^S\-1\-5\-21/.test(sid)) { + var uid = sid.match(/[0-9]{1,5}$/g); + if (uid) { + translatedSID = domainSpecificSID[uid]; + } + } + } + if (translatedSID == undefined) { + translatedSID = sid; + } + return translatedSID; + } + + var translatePermissionMask = function(mask) { + if (!mask) { + return; + } + var permCode = parseInt(mask); + var permResult = []; + for (var i = 0; i < permsFlags.length; i++) { + if ((permCode | permsFlags[i][0]) === permCode) { + permResult.push(permsFlags[i][1]); + } + } + if (permResult) { + return permResult; + } else { + return mask; + } + }; + + var translateACL = function(dacl) { + var aceArray = dacl.split(";"); + var aceResult = []; + var aceType = aceArray[0]; + var acePerm = aceArray[2]; + var aceTrustedSid = aceArray[5]; + if (aceTrustedSid) { + aceResult['grantee'] = translateSID(aceTrustedSid); + } + if (aceType) { + aceResult['type'] = aceTypes[aceType]; + } + if (acePerm) { + if (/^0x/.test(acePerm)) { + var perms = translatePermissionMask(acePerm); + } + else { + var perms = [] + var permPairs = acePerm.match(/.{1,2}/g); + for ( var i = 0; i < permPairs.length; i ++) { + perms.push(permissionDescription[permPairs[i]]) + } + } + aceResult['perms'] = perms; + } + return aceResult; + }; + + var enrichSDDL = function(evt, sddl) { + var sddlStr = evt.Get(sddl); + if (!sddlStr) { + return; + } + var sdOwner = sddlStr.match(/^O\:[A-Z]{2}/g); + var sdGroup = sddlStr.match(/^G\:[A-Z]{2}/g); + var sdDacl = sddlStr.match(/(D:([A-Z]*(\(.*\))*))/g); + var sdSacl = sddlStr.match(/(S:([A-Z]*(\(.*\))*))?$/g); + if (sdOwner) { + evt.Put(sddl+"Owner", translateSID(sdOwner)); + } + if (sdGroup) { + evt.Put(sddl+"Group", translateSID(sdGroup)); + } + if (sdDacl) { + // Split each entry of the DACL + var daclList = (sdDacl[0]).match(/\([^*\)]*\)/g); + if (daclList) { + for (var i = 0; i < daclList.length; i++) { + var newDacl = translateACL(daclList[i].replace("(", '').replace(")", '')); + evt.Put(sddl+"Dacl"+i, newDacl['grantee']+" :"+newDacl['type']+" ("+newDacl['perms']+")"); + if ( newDacl['grantee'] === "Administrator" || newDacl['grantee'] === "Guest" || newDacl['grantee'] === "KRBTGT" ) { + evt.AppendTo('related.user', newDacl['grantee']); + } + } + } + } + if (sdSacl) { + // Split each entry of the SACL + var saclList = (sdSacl[0]).match(/\([^*\)]*\)/g); + if (saclList) { + for (var i = 0; i < saclList.length; i++) { + var newSacl = translateACL(saclList[i].replace("(", '').replace(")", '')); + evt.Put(sddl+"Sacl"+i, newSacl['grantee']+" :"+newSacl['type']+" ("+newSacl['perms']+")"); + if ( newSacl['grantee'] === "Administrator" || newSacl['grantee'] === "Guest" || newSacl['grantee'] === "KRBTGT" ) { + evt.AppendTo('related.user', newSacl['grantee']); + } + } + } + } + }; + var addSessionData = new processor.Chain() .Convert({ fields: [ {from: "winlog.event_data.AccountName", to: "user.name"}, {from: "winlog.event_data.AccountDomain", to: "user.domain"}, {from: "winlog.event_data.ClientAddress", to: "source.ip", type: "ip"}, + {from: "winlog.event_data.ClientAddress", to: "related.ip"}, {from: "winlog.event_data.ClientName", to: "source.domain"}, {from: "winlog.event_data.LogonID", to: "winlog.logon.id"}, ], @@ -1529,6 +1879,26 @@ var security = (function () { }) .Build(); + var addTrustInformation = new processor.Chain() + .Add(function(evt) { + var code = evt.Get("winlog.event_data.TdoType"); + if (!code) { + return; + } + evt.Put("winlog.trustType", trustTypes[code]); + code = evt.Get("winlog.event_data.TdoDirection"); + if (!code) { + return; + } + evt.Put("winlog.trustDirection", trustDirection[code]); + code = evt.Get("winlog.event_data.TdoAttributes"); + if (!code) { + return; + } + evt.Put("winlog.trustAttribute", trustAttributes[code]); + + }) + .Build(); var copyTargetUser = new processor.Chain() .Convert({ fields: [ @@ -1635,6 +2005,7 @@ var security = (function () { {from: "winlog.event_data.ProcessId", to: "process.pid", type: "long"}, {from: "winlog.event_data.ProcessName", to: "process.executable"}, {from: "winlog.event_data.IpAddress", to: "source.ip", type: "ip"}, + {from: "winlog.event_data.ClientAddress", to: "related.ip"}, {from: "winlog.event_data.IpPort", to: "source.port", type: "long"}, {from: "winlog.event_data.WorkstationName", to: "source.domain"}, ], @@ -1831,7 +2202,6 @@ var security = (function () { } evt.AppendTo("related.user", member.split(',')[0].replace('CN=', '').replace('cn=', '')); }) - .Build(); var auditLogCleared = new processor.Chain() @@ -1892,6 +2262,7 @@ var security = (function () { var ip = evt.Get("source.ip"); if (/::ffff:/.test(ip)) { evt.Put("source.ip", ip.replace("::ffff:", "")); + evt.Put("related.ip", ip.replace("::ffff:", "")); } }) .Build(); @@ -1939,6 +2310,81 @@ var security = (function () { }) .Build(); + var trustDomainMgmtEvts = new processor.Chain() + .Add(copySubjectUser) + .Add(copySubjectUserLogonId) + .Add(addEventFields) + .Add(addTrustInformation) + .Add(function(evt) { + evt.AppendTo("event.type", "change"); + }) + .Build(); + + var policyChange = new processor.Chain() + .Add(copySubjectUser) + .Add(copySubjectUserLogonId) + .Add(addEventFields) + .Add(function(evt) { + evt.AppendTo("event.type", "change"); + }) + .Build(); + + var objectPolicyChange = new processor.Chain() + .Add(copySubjectUser) + .Add(copySubjectUserLogonId) + .Add(renameCommonAuthFields) + .Add(addEventFields) + .Add(function(evt) { + evt.AppendTo("event.type", "change"); + var oldSd = evt.Get("winlog.event_data.OldSd"); + var newSd = evt.Get("winlog.event_data.NewSd"); + if (oldSd) { + enrichSDDL(evt, "winlog.event_data.OldSd"); + } + if (newSd) { + enrichSDDL(evt, "winlog.event_data.NewSd"); + } + }) + .Build(); + + var genericAuditChange = new processor.Chain() + .Add(addEventFields) + .Add(function(evt) { + evt.AppendTo("event.type", "change"); + }) + .Build(); + + var event4908 = new processor.Chain() + .Add(addEventFields) + .Add(function(evt) { + evt.AppendTo("event.type", "change"); + var sids = evt.Get("winlog.event_data.SidList"); + if (!sids) { + return; + } + var sidList = sids.split(/\s+/); + evt.Put("winlog.event_data.SidList", sids.split(/\s+/)); + var sidListDesc = []; + for (var i = 0; i < sidList.length; i++) { + var sidTemp = sidList[i].replace("%", "").replace("{", "").replace("}", "").replace(" ",""); + if (sidTemp) { + sidListDesc.push(translateSID(sidTemp)); + } + } + evt.Put("winlog.event_data.SidListDesc", sidListDesc); + }) + .Build(); + + var securityEventSource = new processor.Chain() + .Add(copySubjectUser) + .Add(copySubjectUserLogonId) + .Add(renameCommonAuthFields) + .Add(addEventFields) + .Add(function(evt) { + evt.AppendTo("event.type", "change"); + }) + .Build(); + return { // 1100 - The event logging service has shut down. @@ -1971,6 +2417,9 @@ var security = (function () { // 4648 - A logon was attempted using explicit credentials. 4648: event4648.Run, + // 4670 - Permissions on an object were changed. + 4670: objectPolicyChange.Run, + // 4672 - Special privileges assigned to new logon. 4672: event4672.Run, @@ -2004,6 +2453,24 @@ var security = (function () { // 4702 - A scheduled task was updated. 4702: scheduledTask.Run, + // 4706 - A new trust was created to a domain. + 4706: trustDomainMgmtEvts.Run, + + // 4707 - A trust to a domain was removed. + 4707: trustDomainMgmtEvts.Run, + + // 4713 - Kerberos policy was changed. + 4713: policyChange.Run, + + // 4716 - Trusted domain information was modified. + 4716: trustDomainMgmtEvts.Run, + + // 4717 - System security access was granted to an account. + 4717: policyChange.Run, + + // 4718 - System security access was removed from an account. + 4718: policyChange.Run, + // 4719 - System audit policy was changed. 4719: auditChanged.Run, @@ -2055,6 +2522,8 @@ var security = (function () { // 4737 - A security-enabled global group was changed. 4737: groupMgmtEvts.Run, + // 4739 - A security-enabled global group was changed. + 4739: policyChange.Run, // 4738 - An user account was changed. 4738: userMgmtEvts.Run, @@ -2166,6 +2635,30 @@ var security = (function () { // 4799 - A security-enabled local group membership was enumerated. 4799: groupMgmtEvts.Run, + // 4817 - Auditing settings on object were changed. + 4817: objectPolicyChange.Run, + + // 4902 - The Per-user audit policy table was created. + 4902: genericAuditChange.Run, + + // 4904 - An attempt was made to register a security event source. + 4904: securityEventSource.Run, + + // 4905 - An attempt was made to unregister a security event source. + 4905: securityEventSource.Run, + + // 4906 - The CrashOnAuditFail value has changed. + 4906: genericAuditChange.Run, + + // 4907 - Auditing settings on object were changed. + 4907: objectPolicyChange.Run, + + // 4908 - Special Groups Logon table modified. + 4908: event4908.Run, + + // 4912 - Per User Audit Policy was changed. + 4912: auditChanged.Run, + // 4964 - Special groups have been assigned to a new logon. 4964: event4964.Run, diff --git a/x-pack/winlogbeat/module/security/test/testdata/4670_WindowsSrv2016.evtx b/x-pack/winlogbeat/module/security/test/testdata/4670_WindowsSrv2016.evtx new file mode 100644 index 0000000000000000000000000000000000000000..30c2adc84263bcfff0b595fa11920631f55738d8 GIT binary patch literal 69632 zcmeI5du$xV9mjunzPnufHX$SpN$NBKV!-h$eql)BIB|&bjtxmjT54kF=|_m2R}(1@ zKt=fjfp|!${UfaswH1g~sw$xn5G}Mop_B-fwt(8Itw^P|q5-u~6!rT3&g}Xgdv?x; zy;$(u)86gQ&dkov&dz-9J2Sss+P$rHXLpyREJok_|%bT z1eyby1DXSx1DXSx1DXSx1DXSx1DXSx1DXSx1DDN#rQO?FcJ%JXe|)bb0+UVb0*3TxQ^$ zTt0IAzwEfv?OSl$mXe-@*#FoONv5ToqsNJhVSnIkuY%uJ#CbL)9{R~CN%*R%xG~l~y@bvvjd%-{~ z_AlHk_rCSDN2E;-A?5*dMilVoSZov0<=)YYhoiFAoP9se)d^pFakLI=t6LaXJQ|YK zNNf)diWC+~AhOXZ4`q`>vP|}wkT_H%MLEqmvI^e5;rRG>$ApB;S}sd)>^iIw7CA;! z_I9qULlhmzvYoj6ohAv)y26k|f`vH}2?g@xD{yd2`qYUNF#j$Qs;0 z-WFyNPZwZJVVQ#+_sQAy>!_^2;X}A@eaOd7gB;oPJ<=mtXeM5H7qkc-k1uS;5U3KDXAJtAb1nG&1x!NOe0 zWm@h-Ah$yJ?gx3&V!SaO-6kb&wr+vH)>h{U&%Kx{&4_UT31?{;z?Ir~3nxfXgp~qs zd+pClgr~MK@tTGRRKVgAi}m0fZYA>cPbT654w{7TGbggQ_g1C@cT<>_+}}=g%IsEn z?8nDRMO2~@R;|3X_ccb5!#kY3bu*xFqC|57#ils1GUjp*if9XbcAy~jnsoD~6-yu# zh{ZO-18X(jxTfBy$*3L_1t!iuE5UGJnruK4R!g}oM!{T#2X!U(tMFZgvR#K;)Q+oa z!}mPoN*}V2rJeU-F`{=X=u`8e@WWfS52?1=jE9)_{C3Gz%`l+69ad zOX;x(A75+gOk{#wLPY0|m;qZ*_gqss%ELY!=M~cDcDd%U zd)p7TKeGJH*#%8Gb6+S(%>`Rk*Uf(WHMddV_VEb|Hy?TPO4OOTgrE|^>K@If2C z#tA=6s#hZXcC5W9G)#4lt&l35ki6T@_2#3Vi(f78!(Nkpdl3o+i|J)LnQt@Vp>mT# zwWC_tgOI_3aE2k`*A%fKn2$Wim*VG$%B{!&maA^WZLed36f;FkKYdS%`wk;T-SFFH zt~Y99P3vzpVmsjYn`r%&Iq_W`kI!4-FduX6`O6*u=25kGKQE<%ieF(K&JhwYCe}$( zDgi<2uue9Q9v@2FSF=AKzb`u5i|~u$%_YpIa`^gY&R~6W0i~Er>J!zD(y$v>-izn6 z8xH`NB><}0OXI#8N6In^vmTWu<7~n`*^oA_Hl(5oYc19WAP)Dc zrN*q>szM!Fj^A2o#CHQeHE^jlVQQovzqN4ZFWu|mm#($=<`IVGRypeBD&yXWbJXF( zxXR=bDhw_yxc)6EwbvG0WgMTFqAgDK%LdRkKl6}}Y_YJAGlyvX7vb=5t-dKdmv8N_ zMKl?=@@!d$Yu#5evdgsUBW=xZL!3jk;tl3}!?oVSx7yPXe%RKUh&2YSbTy()-#Smh zk%&L7^7b(6uf$e)>iM4@`R~@Z0&JBZMCI`8RoLL-W2-EwE%6D|I8IBvADhFqz{`-- z0-;cU0&shkFC5Xbt7u4v%KOV+V2)m3JpV~=3fSF`a(}k zhGbG>x=cHtRV?wA(P{geJZYJoF5idY0p6$Na%EU0^=i^GLdId!aKkO0^BN{gJ@2qA z(d>zXG~y|Bqs15J9KKjEhI}!d|F*G=7rr1%)EP2p1Wz=A3P=KUBSTagmS{8-QH`Tj z_)vbShre3mN(!Mb5=gxXN$RKrOVna*G;~rAu6Wwvs?51!KZs%n$c%DL0#zXIO0iDG zidx<*{N=t|<;M#0Fn|dTT>l9Q`3+X{w@Fe}t#_RYy17K&z-FqNbrcaqK6@3b5=l$1 zUhxS@uUZ*4N`BgmT9sa<;?tT=oiZSnp(;fn8CH#Ai#((XbtMiCp+5264x>8piMov1 zv~R#H;lbaW%-O%#}LKzY+@ zW63R17@Y-aG^sBTZ{7@gSql-1TGv?WS*J&!XHlD4CL6J?cQmTSP`<`e*CKC{E~_1$ zq~=Afs{wB0O1hIL$)nV+s8o?SYv5u@ltfCci_FQ;H8@Jus|J1>u*HtTbc&rT+}CP$5pT3aoGErasreW%;T*-)}NUE%sa;c({HrYc< zA|_Ybo?mh=>6ffbzuf0H37Rx&dwDHMSHhQH?0MX&{+As}V9!n1ZdUeG_EaTSmDsGu zi!$HA!o=TphNS^fz?{9X=lVbp8DtRh-DtVe2Ksx4h+{|ey zwlm){QazPChn>>`hA73Fjy&DUf6dVZ&GSxdFH_A^HBTi^CC{wM^MFV5Ja%N-qD1nX zq2#ILspP5Tnb~Y=_P77chyM1t<9hTd=P0qSoIU8A(Zq3_9IeSc_N%i8p8e|d!K0i3 zW&7yav(8bS+-Dpdv&vDQ9H&}|U&g@^pOyIatIyqS0(z7`RryS^wX+ESSd>4NKSz;2 zi^`r^n8=^gl|Pj~l|Pj~#}|LzJdVeEa&FP*i9ZLM0PT5K{#5=nmJ4aq&)RHk0E6r7 z`z&oRddGbJ`1-2``IBZjuU7t4{#5={{>+R&{jw(c*AeKSe)YU_X1r@R(rTQIM&l%p zQn73_R5~A;XSvxXqf!aAX1A>xN?p^=i?|sI{5y*eq{GnN1$AI%al8+4KGjA9~(jw3SjuV?O27DKTgy(gjKuzT zawVCQtZ8jH%?FR#UiNxy(T)>o)y|41U)pe->CT>cJ6E1opcszUm`J1kG3a13a6ExQ zJFvZ68B`fm8B`fGYX&{!VbF(muZ?}|*t-8d81y-1P*p#@)U7k#b;f(T8Si9JKi;J? ze+25M-waApIF zo64KYo8yZ&@1LZ+xkWZ$-fgdRV(#q$ygz=6w8 zk2k#*VI6`zneUv{-iTwIokU*^*rNqcy3pOP8SI0NfGVC! zph}=hprc2iUd8j1Lv`;bDxP0g0#yQ40#yRdj6nTTJfC-7t)?^BM}J0BHyh*F^cPeixZz^vpZ)V1uR6PB7bJ6s1Ji?P!IBB<&x+XPD zZqw!_-<-*BdxUm9t&T}Qv?kw()xPD3V?=42lfLcyj%eYNcH*gqQthOU%5T3kPq!JU zJDgy(b2GME)M}?%?NqCsYPBg{Ld~;K`G8XKy>-_s%_QG2Xu4oqg(j z3q0SNNsIC1R`#~D=bpCY{bEnI`mfg!pQ?YV{;B%s=;@!{5uXoNx4)Ojo?lh=RQ6Q% zRQAk_J^dQ-`MYsE;?uqpvjL%=pRjQAkvC6HX?tqjq!Vawcq9;u?Z@Vl6BA`Aj3aj; z$^pE#qyyg_NM^7(7F&kjlS#~20hh>%M?ZsT zkj_pC0=p-L5ZiK3Y*p!ED;gp;_l&^;q@D4t^2Ar0F20hK_?95YdysnOVLZ;DjWf$D zUWqujW9^mY=8AJ;%N#PCYQmF53*Y~y$_1<+fh_AOEAbaE{slcZnjmZvF%dGnPWgdQ0o1l5{!K$$WM)X-ZRv;U# zlw5(|2JCkYwiEqHd%-{~R*9tbwMS6d#!c_rR-_r}xp+7#YfXc<-!uwr9+W?oKMmoK zXV`WM3Yqr4XWjcgd%`SaU$Az8W3r_5*uw8r{?X;n)98JFSNSuEW|cotV8Q|APvy^{ z__H?{5FT5Eo_PFe^tnt7KV*WlulVRq`;;Nw(#gNyTK}dPBq< zTWZ~SobEO7$9U@ROFkV$H+&dW0}HCFqzEY7oV{6Zb# zWh&^(E1+NIhs_7_Jaf^8<{tgg7u9BRJX4lwT6j0e^bBLI4=^^SgySLT&e0Lnuw9Ls s{{tF~8*`ZdFzA=}l=;A%sdl ziS1ml5Ft<@RZyr(kqR#nQq`*}A#qbwp-NRHo(g>_ZN*DpfG5;)QLDTR|G&>ZGh<_` zKqbV(zejs!U)J7h?QgBU&WSTsU6@|1R%~NQ_<>9K4J>Ka7i<*y$o;^4<#^FUD$u3b_)N-kIGiRmpF|-3f$IZc6s3|Pe#)J z{WtZzb>z*__8qoo%)-#@Z)vkXr`l)ChB3Yme}?!^%WEI9<|*i8*$$m7?|b>*_;HT? z7-I_??D+!vANW6#Y}=q?$?wIr&-(Tu$WCL=s~h&A%>S}{+S~k2N2K-k+u_qr{*5Op zFFZQ@{I&Tvg5Dso?%+>{Z+$sl!S*A2KYQPqk^b=Y?DIQcz)2`I(QjAK^2a zN3U)RkSw5I$M`NgkGUFt@33KfcB3_Hd+=Rps$X8$O9YL^yYN-)xB6_xj@U))yy7$> zz$Y4wFT<|bqwlSSc8}A34!X*aI*Zvc)af`F4?dBy!!ULUlV-V`1(^qZJnS4y*%xiq zt;AHX^(H5hb_il$^%DP>>u7^@z$P(wD{6)z$8C1Lowa+h#T<|=;`ocs1ft8OER)D3 zEt3km>}Cwak$!z=hdtoM7D1|pxkRqZQYrZOMs(s3FTa+y83@u>RVQQ=O4tqP+~DJM zYAt26&KIYgNP-Fj%cH|9!1Cga8M_+}q+5uH>H_YRwp-ANZ_dfzhISCs7vZ-$IF`Yk zqG=mU0sB4ZJmz=Y`)C)GE;^?BAzFa}bWs^H4i9e;W9oBj*>xU_7XeSk`jbHx(bCE# z)5)GT+V^2YnoLU~@`+s5vb5!4EQ%AtPyX6v`<)o=s5(nxtj8cXJ?(FJ_Pwl4V8<00 z&S+V|Nuzyp9oCy+QlQ(5ul5^NM?3LMTP*5fxHK9|&=Dt*U;Vrj2e{x2Uv-Ki_kM|X zz?()}vcK>2F*^^zWqiC9p@kWyR=W1#@eqVhc(yTsT&IP}pwER9lQGLT5u*DcIfp>1 zIlJk!J_}MoqwydFnAPaGy|vJRT0$t$xah7V(!n-63KI_7kllsAJcNrngZ>DH; zrH?=Niv!G=XP&t3*B{KAJ?(zq2tv5~T|6(p@v%q}XWy92hQNkNtc-J?hv`HAa>gOV z$13J|VoE+_JAU}B*$cBjIPlcf&+kp%_Dau2DpBgbcK^@bf5#_zw(ouMM@RQvtEQ5F z_+H^Ot`4Q(!7`eB=CVv)W_ZP^d(wsa9LAXy_u-e%U`E*^^%OD{uOw%;qh^>5)3|Pv zI0sWVEse8cq6fI>&YgabPqbEau3K>g>&lks32cD!d^w=b9WD7B_^jG-JLw`}rRnZ? zWg=Qx^ebJmh-~ZKVr9$9WMt*IU;CMs*8UA^H$Npp>)*6`29zE`tszW#UY`PaPM(+H z;)!2plqNgKTHR4x&s7w|Yg2p-csERS3t`l5RxKMoh;HAO_ z@PHYxZD@zC4mPhHuU|LDMr<4p^#Xp!@IWu1J&H#=`$e=6xXprR3`=?tUyuLtrx%Wm ztzEezIsBc!LuLZn`T9^po5J~kGabe$Z}JbcZo5|pY%!| z`|if~4EDU}$PGgS%kZTDq&mHPeCz4Myh~|!Vr~uRDnVxjc2@9PLe|&=Yj@)_gi8C0 zXpN&i>SoKBA4Z=sQNdfpJlZ9!{+iQu$Z_Fo7wuy1U4;}iP1zZ=Ig*Ff^(`%1zbXsq z=)>2t_76vk(4Kdrd1rI0U2Kk*FcXarp*7wdC+*GT+xN`dF+@rkwSsyMbrE&m_c^z@ zeIu}m_A%mGI!2o95~8p*PVez#v@dRRZOhiuI$Mu7*XF^w0Hy^*Q)DM?rHy>uJ%zft zeSFEKeJwWBx6s^otc`04lw0%;2-+KGb!w&MQp^_bK z`eOOfHvf*c#YW!Qanakuf3A=n8IGbdt8MPzqPMU8tYn}f0wN#+A|L`HAOa#F0wN#+ zA|L`HAOa#F0wN#+A|L`HAOa#F0wN#+A|L`HAOa#F0wN#+A|L`HAOa#F0wN#+A|L`H zAOa#F0wN#+A|L`HAOa#F0wN#+A|L`HAOa#F0wN#+A|L`HAOa#F0wN#+A|L`HAOa#F z0wN#+A|L`HAOa#F0wN#+A|L`HAOa#F0wN#+A|L`HAOa#F0wN#+A|L`HAOa#F0wN#+ zA|L`HAOa#F0wN#+A|L`HAOa#F0wN#+A|L`HAOa#F0wN#+A|L`HAOa#F0wN#+A|L`H zAOa#F0wN#+A|L`HAOa#F0wN#+A|L`HAOa#F0wN#+A|L`HAOa#F0wN#+A|L`HAOa#F z0wN#+A|L`HAOa#F0wN#+A|L`HAOa#F0wN#+A|L`HAOa#F0wN#+A|L`HAOa#F0wN#+ jA|L`HAOa#F0wN#+A|L`HAOa#F0wN#+A|L|)2L%2Jdqw{L literal 0 HcmV?d00001 diff --git a/x-pack/winlogbeat/module/security/test/testdata/4707_WindowsSrv2016.evtx b/x-pack/winlogbeat/module/security/test/testdata/4707_WindowsSrv2016.evtx new file mode 100644 index 0000000000000000000000000000000000000000..3f9f51c4f98aac5aed5e44b3716a7c4460ec1922 GIT binary patch literal 69632 zcmeI%TWl2983*uh_U841*LH~|M7V6KQc8+%nDt^PZ5(5_D29;W79#OtylZT{-UYli z5UVYsrIn&2N^g0|3qqn7HL6rq6&1=uB~+t;KQptt-r9l) z9`f)XYj$VOd~?ose&@^?V@8Y9W3$DAHE)ri;4;2Fi<)(K%^?qc-m$Uz=ZCID6-Yn= z5|DrdBp?9^NI(J-kbndva9@GZ;`GQ&X%7F!_qVmaFY_|~DA18I`_`_jPx16&Hn#J@ zmQ=E_jx7nZdo5-k#m(M}HC{2xAo2kI4Dm^~x9@Y$4YbK^3)NsK9M!*T!3 z^^gDc)BIn&cF(i*-n&P3{64&c$1m;Q_58X1&g7lcFL%C)o-k^-)2`u=9prXvecVQE z$qH7o3eLZeJ#i+u_*Q$|F50{mad80`;$GHf5LU6Xw$FO;vtUywDIjJN$36I-Mag+9 zj<~-IEx6k1ud~(kGDQVB(@+FL0 z8IF0lGc;~pF|Z%S$q#}W_rJOhjm|pL5rh_y0EZ}#7{|k>h;!;o%c&J37~TY)gmp%} z6lP0(Eg6fpHE2JN3Yju9@#Q1wl%<%O9&A7m?rnwiO+?=n`La z4f(_SHRgfQH0F}}YilrPrx3V+pCF5*B@)mp2Ek!@QVRt)4&tS2YgY{!-FG&0{JsIsaLS#Jx>+94Q>JZhION^DrLN zah&(#vmbMN5JNP9ULC_{4^+w^+B&TPuup_zdLbp;>U+>-1_qV=ofCcH7oc_^_!h@bKy&X$N#vw?YTny{oa3`t@Qp7 zPd=kCV&B6d-?7{dUg2~Km+FIVYEPn^tKb2AXYgL&ta_;&!^*@*kXN^0PjK~%+xy$EZQkM<3_$x8{Y8F zh<_)+nXOwK{M_2txU-&R)X#D#xc7_oRy&*SUA>o>N)MRzIFwFfFJW4;zg+ULe51jw zm{6FbSaLVmCLAZ--i0S)2(Pssd=KK4)`Q~#yxe%6#Swp3~ zYrCU;FMo`fVYJ2)yyxS5{^k2zv1{5=4Xr-H|K0h!`aU>`Xf`f#-u z-@({#fDuP;44=i|arfuzDB7DuEk%qOd)o@97#=9BJWaif1icR*JASk5(e$Z%g%c($ z{~HUn8=g8tj(Kav_XrltOkgwZ-mp_RpT=mN$M=%+^M56oL`enx^4~_=ZMz$t0gTUH zOSQ0GvpdIMx&5>F!1!y=e*3NW-$`E?#ws_8diVzM*H6A6SnnQuj>GAaTdw-t-9WzV zL8>)~4_5)+n{i9pK3rQy<~g)kK>G!J=g^Z5>8@1!XfXFRs0dh+<2lb`HlZp-_3v%$8hCcvlM1{ttgGYy4qp7A<95 zX~yMTKhD<5bGYJ{cjIWNRz8UStQOx`XU0zAImu%$U|+&Mi+w6M=e5=I>qkz^kI!4Z zjsDtk4$ok{oTJB{F~9Jb_ttaGt;qFM?cNNWd*IcB+2rTRT$v+(-JQd}dVc&Rm-*Fg z*xq!l-oXaf9F*(%E+7wjm9W!}xw4FYYv;G8mS24i<<=OlTy0D_zIC%fv=`<#&@jFO z4Ra&o^0*Y_!+);Oj)nu+xu&l^zS$tZ#=g=(n*<~v0SQPz0uqpb1SB8<2}nQ!5|Drd zBp?9^NI(J-kbndvAOQ(TKmrnwfCMBU0SQPz0uqpb1SB8<2}nQ!5|DrdBp?9^NI(J- zkbndvAOQ(TKmrnwfCMBU0SQPz0uqpb1SB8<2}nQ!5|DrdBp?9^NI(J-kbndvAOQ(T zKmrnwfCMBU0SQPz0uqpb1SB8<2}nQ!5|DrdBp?9^NI(J-kbndvAOQ(TKmrnwfCMBU z0SQPz0uqpb1SB8<2}nQ!5|DrdBp?9^NI(J-kbndvAOQ(TKmrnwfCMBU0SQPz0uqpb z1SB8<2}nQ!5|DrdBp?9^NI(J-kbndvAOQ(TKmrnwfCMBU0SQPz0uqpb1SB8<2}nQ! y5|DrdBp?9^NI(J-kbndvAOQ(TKmrnwfCMBU0SQPz0uqpb1SB8<2}s~mAn-pd!uHbu literal 0 HcmV?d00001 diff --git a/x-pack/winlogbeat/module/security/test/testdata/4713_WindowsSrv2016.evtx b/x-pack/winlogbeat/module/security/test/testdata/4713_WindowsSrv2016.evtx new file mode 100644 index 0000000000000000000000000000000000000000..5d4bb4d159ae89680ba533a7704a81149e9dcd6d GIT binary patch literal 69632 zcmeI$No-Yh6vy#%-^A^MzP2Cgcu`nXF`Zk5@SMKpl&c4HmqPN8X~TqzjKGS)Bq}R_r1*g+F)YHeV^CPsQhr>jnDuB2q1s}0tg_000IagfB*sr z+*6>nw|nEh{sa0yetg{N^SBr5M}c!ivny>2&c@OI{oVUny>P?L@h!|Qn1!L)?|HN9 zx$z}tjk^AXeuntB$EADJIio)Pn5{nj_#=tGm|XX3AL?57gz>D?`K{zfl9?0w=u6u2 zx}PTBw<)$wZJwXdj>p{Zadpx^Z{d;jhn=L#k|kPG*{19MSbcBx#q#B#CJ1awaBcg- z3uz7iezN7!od=uh!XJyDEk3K6c+~njJFTxiK|jt<$y=)(wl3?pA)UXiS7Cor_+?Gr zj#{7fs_>8s@A;L*EsDlg&IfdTnH^DC zzdn~+qyARvTcfSkd)H|9hi*H|1eMCKTB~&32HFd@%Z{n#p{PeC`1(raMU5+6(HkS7 z?TC6mtiH;M8dT{jz1q@b+;S>s+cnre6`GYw78G_T`LK9;&YrU2sHTc)tR}lYYugm| zS`u-yW70UR&9+Hp3-u~^%6T)3e<|9tYNA7AJ(_+`Gz6zB<*bk?Wv!44Cfh^0kY@Uf zs!8^I64oQBewAfPlP#Ci8qd*5n&Rb4dE2T$U#s3I$UG=xvve{m$Ofyv^51dgtu_KC~?=KBjdWkYicy9-6o5IkE51 z$-7C5E$>WLr#+GBMum210KPz4Ly6QM zjoTNk)`DD6sq9vO?`pnqE&X8x)u&YO!NvDVCLheS7c_+JR&N`WnA>!tZq<2{-kX%$ ztF%Pzn$<47H%Mhbgr4ob4ja^bxW?Hmp&{yk-w7qLA*@-CGOxoaXC2Cv%=+ z)3Uizoz2VHRD~)nqnEN+53_iNp-s2Y>a5mkR2oLF(27x*JTb*W~M4y*~P|JNqdvo2cI8t+;xS7?<#y7FD=6ys%um9T| z>y;nFD)$+CJW4CLUtj&1>&K=yJiXGbdsCF^9lGwjVyiy=8SGhhav-Oj%5O<8U7%ON zcf)*8(&&e6kL{1vX=rpYc4_2g%T$|9^JQ&L+KO)FxMs~AYNk7Drdp%*x@(fUOUHVx zn^1R?EdBA}T4VJyas3rZ{kx2MtLpF7t6xdvqt3<~)Vic*(^$_BL>t^H-CE9>{V%|T8Wp-ne*lGVf31A*Y&Bz@FVXzb@#hv{^;FuP3C_1raBnq zR=>*Ds_jPY5zV$jqi>Q!r{4Vm*{G65qh%c`?b74Y?=~-6Y%MCEJK9=@+SobT+A7_( zYoaz+s#e_E`1V%o+H$qlrMQ(z`Ry&nkI|!YNk>@Ly}w4I>_}>)quZmF%4(xI=_zd| zo~_>f-zyvlAbDVvE$gA3kA8h7os|8(imE#2+8rTYbR@O zQm>r^tHLT&ND&|^C?NHL2q`Lv3W*0)6cwmcA;C+aAQcJm(ih+bL<^{WKw7@<%$c3F zv8hmm#KSkM*_}CaF8}j8m)$s1wfXX5t!i73luy{eXJBcw-e7B%+rIC;v-zvru0$0` zKmrnwfCMBU0SQPz0uqpb1SIf|0#mj5iG}40_&0uZ?DV<8$NZx}m)YPq51i%g?Hp|9 zgmAYO|N8y?@gH`4L-*g0i%$NH zCpv!r=ZVudE3XATL14RrKc2kr<+uc|uO0i)BbSEz!dLU(+y4T3!d&Bhb{&`OAdj27 zvNmOFR<&ho;Qk9ZbLaiTmwK{x#g?pwhbwrH4MuGN*&24yj@kjdR%{L_Rpgn)^&mbM zk@AGqaaXr_pJ)X7`$o3hZ;~%pfZCJ-`63_0#nd6jWHT!>;x6`O%7G#U){-O(k zbcKxNQiZhTGC`NU7YXr9zq7N$KIyY9LTVY$QiU$dWH82e<0hWsm0MYxMn;ZR&1EuX zO4(hwxy#Sfsr8J_xUsn4vZUBxU`5<;3Gn#--8p+01IS?^5t|EGQ`X*xn|S4%|7B>h=>)P?5dep%f;^6gtB7;z!|VA?BN!I~ zPtN+%K_0Uu*-Ogl?l$d5P$5HRB$0fokheTzc^ZY{4dL5wcG-l>#yDy&l9-jdV7cs9 zc>ayNjibf}0_SXLpr=v2g%0bYH%SRDfnB&&Up?&&D2;l{98v_(NEldZ!ZaQ%@ z=J7d9(Fx?7#Y9?madXgmEyx7T=3~gfU5x{GY&mpLOPC4_E?O(8Y_P{3MF=Ntz#hcJ zJb{Hejr(D|4`XhRVTfkXt21~Xgi0NRob4Qk2T^^zL0=yXk%vRJil`%Av-coJF5au> zr*rlR^p`FBKJT*K=}e)|?#b94$cky{PRwF_nMFMet=~fHvtH}L)6kuv7 z>;6lH*H6Cn&rjd@={IIJetl}sMJyfW!U$Gy$?seqlTUGa#as8Jo9eSj=dL(~Pksk; zmR+l7uv2kK^65UDIqrtppn&LC?VO!=1cyuixk+Kw44XS zc5PvjG1mRQ#JiIcotsL;F4@S1F|mbrCHXtBDmXW0u$f$hYN|VDA?rTi^KveF{arrq zBzn%hD%y(Jk5qR@RBG6lx;H7+?MsbgI2&$do%73g1?8}3u(bz#IkxIs+YNP&Y8me} zl;om|=I0bzoW(4tA&q{W(8ypxVdt^kwg*cnbZ0-7Abw;ZEnar~WE#FXcx3zW_SF}E zaOLdS`t^h9p)dYDFsz0OMwcxuV!be8PDF0w@h-CPooHbX7^ZmZzy#%gW1)7#Dl?R? z@OKZktW#F>^~}3(*g4$KyBdpF4ABn|{v?@28x8a;`Zn5!i9d|pYXmYUrcfWhL8ASWqr!R*;e8r)UUhOqh=j+`MgXZ!pFdvp zEL(J2+EF}PN8}~6Sw;I*e3sCk!-(V%UIRE8-zct*;CjS8t>F0(?l~u_=-V8wODO%M zYwHB^H;}gA;^N-Bid<}I$}ZuWDHN*j7}=W36PL;(cl6@Vvi28KN6}Kzr50Vx$@OR} zy@V%G`T(wuw9=`)UH@BNd!goNG82anAXBKHEONVZ_Av#$c7SG2FT?;b&%& z&e3Df7+-wNvPrC^O|hP9l`X<~5MG0rO;MbTl`-f7_U-mOgX-Z*%;c3;~Qxk-;uVtQFL)!_3`kZ zE3~8G2+o5zw;$h8A76W4X`n*_5|DrdBp?9^NI(J-kbndvAOQ(TKmrnwfCMBU0SQPz z0uqpb1SB8<2}nQ!5|DrdBp?9^NI(J-kbndvAOQ(TKmrnwfCMBU0SQPz0uqpb1SB8< z2}nQ!5|DrdBp?9^NI(J-kbndvAOQ(TKmrnwfCMBU0SQPz0uqpb1SB8<2}nQ!5|Drd zBp?9^NI(J-kbndvAOQ(TKmrnwfCMBU0SQPz0uqpb1SB8<2}nQ!5|DrdBp?9^NI(J- zkbndvAOQ(TKmrnwfCMBU0SQPz0uqpb1SB8<2}nQ!5|DrdBp?9^NI(J-kbndvAOQ(T zKmrnwfCMBU0SQPz0uqpb1SB8<2}nQ!5|DrdBp?9^NI(J-kbndvAOQ(TKmrnwfCMBU o0SQPz0uqpb1SB8<2}nQ!5|DrdBp?9^NI(J-kbndv@P8oiFYAl~8~^|S literal 0 HcmV?d00001 diff --git a/x-pack/winlogbeat/module/security/test/testdata/4717_WindowsSrv2016.evtx b/x-pack/winlogbeat/module/security/test/testdata/4717_WindowsSrv2016.evtx new file mode 100644 index 0000000000000000000000000000000000000000..f27db52c5362e79c6a22584388e2f2ae14f7543c GIT binary patch literal 69632 zcmeI$U2Ggz83y2YW@k6+O?KB#l@dZ*9GbRCi_?TAg%D_Q{gYab-6VFPK_D>R^-sJ% zk$0WOq!&>jLW(Nd0xgwN35rxzl~9E!MIqt}gaiT=#6^*UxGEC8;DWSN^ahsqJ2MmS zt~W6yx9>#bojLQJzvnx1*6~njW_Z3-MEl`K1!wr_ApvxI?IAaO-@Uo+ zxgWmuRC5crrhvEC0q-P%w}R#;z?L-dY5p1F{T{EcQRhkaX~(VX(~f^d@js5rt?UBJ zX4=N{An)Ic{z$T=t&eilmeqYZx*lWfFx$M;){ezo@Axe}ZsfQ#{zJ|+8oB#!=9IQ^ z-ea47>Pm53hFN6Z~1c+I_9%&i5LP%gj}rx9VgH6If=; zb=M;ocz>gDjN^(kdgXK)hg|O`*;j#4i+p-N&*6A6jy@A$oP#a%A&|?#OFbH`haH;& z9Ke#R$wztQ6a5K{G3={R#Jf}Lny^MN$Y*!)OxcpNW_Dc8;4qt*BH28rKktTMbh!X2 zKbJr%@YdraEQnY7=B{=4Y!o(6sS2O@x%CJF=J+<=#7n&JdJ+d2Xt^r6AXt!(TX=Iz zv`&Xk2bgrZSa2b}b?Bj&H}(qH@ycx}Ji-K8T8zlL^Q@&Lw(%x@bB_N$jZr>cX5OlF zEYRITlh_oH{Sa@Sj#}LR&Gqbb-kAR4vmEsNI2XC*(fD5y6l-x*S)-Nz_csP2)GgmU` zXNz?X+*V7SGY#9#twTO#n}Vf%@2`4bU572%oUTzRYs;n4D6@}v6S??W7bkGa4SdOU z6sGrK8waxq8%yR-UD2AIW?+r~qEV!gPTAIKsXezZP2su7HU`LbA)WBL-Ey+c*p9Dp zi4HJwiVLaY#%)RKh8K8^#zPFSUCk1=zmj%PWiAC9T==f|NiUDjaR}q+!$Vw{V|-B$ z@_sje?&jLQA0}=M#ar?Bccz(COU@F<7eWFbW<)C9m1hp7aFjE%KBC!ez)guD*MqGA zHZqh8(4Abb{MriVlEx;a(SvT}`84g$G%_xZRopSmJA2LvV#43bGH-9$8syP?=G8y` zhy_wc+uLgOskx2--Z*mhOmT6&B_?^`v;KCXl%KDQZL z(G^VNWRlD&NP^bVdW+xL=Qj-y|~ zS8&|rseUyX6C8N~eipdN(z-Wl%e}N=&HOcL#(SurnAd!adB-COJZG-wfxfMK71yMxM4j?fy<)Gi7!pZRK76?b*iXk8npBvRM}P-VPmuHxa`V`YmUzPZI53)x^R5$ah*nJb8U}n z9bx+%`ngmK)Cl)>R&VnPzhlQZp8}oj`^|n0>*d+pPkSrv^Xl9RzdYEEWpKb{&VEx{ zq;!ePCme@88;O?sET4tjcO1bW9TJd$1SB8<2}nQ!5|DrdBp?9^NI(J-kbndvAOQ(T zKmrnwfCMBU0SQPz0uqpb1SB8<2}nQ!5|DrdBp?9^NI(J-kbndvAOQ(TKmrnwfCMBU z0SQPz0uqpb1SB8<2}nQ!5|DrdBp?9^NI(J-kbndvAOQ(TKmrnwfCMBU0SQPz0uqpb z1SB8<2}nQ!5|DrdBp?9^NI(J-kbndvAOQ(TKmrnwfCMBU0SQPz0uqpb1SB8<2}nQ! z5|DrdBp?9^NI(J-kbndvAOQ(TKmrnwfCMBU0SQPz0uqpb1SB8<2}nQ!5|DrdBp?9^ zNI(J-kbndvAOQ(TKmrnwfCMBU0SQPz0uqpb1SB8<2}nQ!5|DrdBp?9^NI(J-kbndv zAOQ(TKmrnwfCMBU0SQPz0uqpb1SB8<2}nQ!5|DrdBp`wRL0}wHD5J>8q?gASuclDL z5*9I!3T82ZI!o#-slm_sNC*9m#xaJUuLc-&kEVFn&oedpOn~P0KET@6UMXs;pDh+J zz>;aqb!Q}1*B#3K&a&;S9rs#vBdFp8mRsg#9ekAM z2%j(D0LNY7x#%W1k1Fq)C4g;=y}lN(hcWL@0GJ#aJ2aQ%{8`t|N4*3*elG9X_t(Sc z|MU5ae|hTh@vT>~dC!B_Xaosh@N5@`aMBIA-joxcnHpu))=b^Ul2w`NUem|Vay*v% zFRp5Fs8fp{#8H~nTJpbE4*aYa_VJ}veH`f2#}qq*YLmQ3r_C< literal 0 HcmV?d00001 diff --git a/x-pack/winlogbeat/module/security/test/testdata/4718_WindowsSrv2016.evtx b/x-pack/winlogbeat/module/security/test/testdata/4718_WindowsSrv2016.evtx new file mode 100644 index 0000000000000000000000000000000000000000..43ef6f5a7877fefaf1892f54bc1fd04ba7c6f87b GIT binary patch literal 69632 zcmeI$S!`5Q90u_Jovkwiowg8+!EI1c!L+n=84#D$(kh{VKoL!dN$E_XbUM{8EH*}h z8WZ9gmzeOPCT=fAO;l`rGd@XBUo_D-P1FZtT%$gi@%zrbcV=2!*B2kYJ2^9VIm`e2 z&bjB_wzoLkH&QIv{4ElkIF4V>qGpZW{4D?ZxbfWb2miSeRUiQgNI(J-kbndvAOQ(T zKmrnwz+VdV7KeKdmPYY6zP~N@dz_c?Pl0UO?8I-+obhx2`){`MZEEkK+8QoMn0;So z_Cwt4t61$7vz1A+Yw&M~f4ZIhi!u+RO>P&UO>RF2`Ckjp^V}(%8=e=>bvXVd_$SHA zd2NgZb+PPA!TvVn?L(cj^Xg%qf4aQ~qrbad7XBk=kpgSiVoYHhj{EH7t55wh^pV%# zdA8L1_Q#!{hBa{i^;5Z>r++y8*p|<)J@X`b!d%@=b`rbnAh+42aqG3iR@80b_CZ-_+4+U_;g^e)i&U}P-%X0&QZiGmp{Q+h2u6pkg(l$3^h-=7BRuQ%jH`U zS2&{I%_Qw6*ZN_!l}D}#TY3n$~&Ct|i8!H(ggStes%;+9}OtXUDW8*JK@#H9vn zh;~P98?xOQF1{E?B*cb2&7857RfBJSPWx)Ar8VRo~11sF%iUsjek` z(fS(gU8s;DGZJ4ul1W>dvD}A3;ezn&_e-qDWn&yg7fHyv5Bd7~f;&9@UD~=);}int zY?(q&{dzNX){x+$z+vxvx5?PFUlaSZNTGU8mvVUwZG?-+>DN=}z)=_Yv}?#8-WwSQ zM$;He`r}kEXNQn+5}zQ7q$LwvS~;}$ZA?P=U|<^pWKx!ldW~*6aWUq052k1jat>l5 zm0a8$v_|t{Ub%cdGH_Mnz-=le9n=`60)zAKl}Oxcu)PRjyEWVOn3&seqxR#t4c~2; z+g(O+RunG9Pq!p7s2rSW#OFhrU4$Hoa8(}ePuL#xjBNzHTWZUru}qV#irF$`#RPN- z^A(RRzb{E!VM%MUMr**;q)SOlyL>3(wmuy3Iyz{3Bdc)E>nyQCY}w zdgG@d4CX9FmoVZ#?HI-1E$Zv3dZze7bVm ze1a1xT%pCU%cm{p)5-A|)+FA1yt*1G!F4b0Wf1+e?YBd2oTe&+u^W-+ zEmCi`oWt4~)a7nkzhuKACBro|Qjcg^c4JWX%4(}k^U7|9B_9;js+N!V<=cbue-d>+ z${#=~VG=RwsJ|4g2}+(QsJWZdGMd4GQQT#D;Eu%c|mqh=TO_Tc9K5@W;-YdN=g z7GJBd&-t_6^}t_(M{y5^0=uAiz&(sDxP2%2USLU%#WmPz#nC$a1~XuJpwNeM#o%`L zXKgP$2QfE_L2py8w|H;FgJrp`bUpQZi;;2y;mycjp2L%aTYLq+9((iEqx-sMo?ahq zec(r^bVHCY1tlatxF_87#nWFOS99}c4=Q(=p8RHB0S+*K$ZceQG zD`m5AZh>hFM%|B-u`))!?v5fY93NkD8DG_g?G0Dz?W%FjLAe@Vz9vt2K8xt8eVgk? zvvH&%(lpW-5-r=17WZqf#FwjSuj%ufU>TO?lF7R^N`b1|T(t-sQMD0%yGX&#rVq*->7Hg7RITn(D2!r_Ac!1%xe^T7{g?#f~sd~Vg zqPoQXS!sQC69mWcvs!rKMK!dlX?L&mKzNH~8vsaDiWhcL#+@`6Yq+#5h82ZZYFYKJQ@eGs7cH+YaylTAQtAFs$ckcbAcdT3o#uE&0LWxMCN%nG}S zv@CGt42Z%l%>^$;GV^!nNsV}tmXsvX>zT`wn32N}Q#w%7er#L*6I!5cEjgVKW&W-W zHfFAz+c9|Agvhvge&EDm?sqg_{?|s=PUu}4%<92LgV+G}y#uP(AGgPP_{RkLb;l~X zS!(y*+dJ9&_}ZrrUD_Hx@2%=`Dt_pGB>qtNBb!w8{hOo9Hq3jzD|LAH9huoUIw}PV z#__5-SIe5a)xCnyy#{8;`FWKg5s*_vaxHxQqzahDvl5NvlnIoX@i0oP-HMl+Y%8QeI%cu4)3pd{XE&RL<%rt3dacN>5Gdoo}!70C^ z6VU>t7QYop-WMSv=zA01SC~Y;UrLEn9zZ@ne%eeTOzZD`5L6Uc0e&3ER^A z6r@W3qag^udVti~pTOWV@wCT9L$H433{P`Y#3(hR#x<2r7o}Z9b#cMBj&3H~CG3XcGu!-C^BetmPY%?ixC$y+Vt@xFuk~wgwmA;bpW*AZR zn?P%qk?=p5{3GM1>;|l$=~HBW9JkAHLAzTJy!1Obh3CcdwN2#izbvTv{d}r3{@4s*u zTCJ)oY9??-EfH1bcyk<|Q35CHv4$7`q7j4ov&B>YK0ID|)xMiL6AO6GX&9>Bh z1#0qD)BC_RlgFJ~y6=2tG-0$BeZO(hzKyFM{`RH!7C!U$chPLm*IRhi^Hma?i`wTg z?-*t-rl?An3Mx8{k=`Q2XBFnuOI2| zN7x&nz@kE;Up8xDJ@oW{`8%iI?%fklVTqUM-CUw~JVbA}<9&#NKB9GiA*OnqpCryB z_$D7q@J&Ac#|Zy|@t)s3gm=BR^n3)*?;0SDihc-0$zPJ%Cvwn9{upX_0-D$?S4rs(ljd2UT%N~%1<8!i3nJ>2if1FlEADhbd%Rrm_uH-mQNqR3$vy#%FCr2j9`1fsX_R;3iHYB zMj0=~gIUFU&U>g00lBRDRUqO(F1ivAR~q%S<)E9oR9W1jg1GpD8U^vdO@NQbmU^iJ z1<1w1EaJ~;OvytZ#Dm##ZvL5%w!r%U%54aI>;d07sE113VEZ;ae955La8Euyx<~P} z2|=Ss02fgY!YKA|E8;r!;e-B!5;P-$Jzgrw(fp__mMm$_3B+-GI|y=;IVC#hU4?$~ zb6Soek|_}W_U(LXQo%SK{VF9UTW>fm1``_|YBPfm{;aporkyD*+VJ;PUStxL^ z*Z#PK_|rNi&QqF50j@3+69f2$DMX%rG7lNpuM$3{KBO1#CQb)RlQ=E@m-CD|+l_!D zIE_^J$meCz%0+vu-UklvHh60?pfHboIa;x*PArW1IEpITgpd(bq(PN#F0^9O+}gy% z#}I&}8W&u{piePs09An#r?(ZCM_Wugkc4&$(FRn^t!Suic&@^473y{vMbw2{b>epw zxH1G5a&6~w*Z}gTfIhLxhcH}ZV@S2mUZVFSgx8eSy=`8)9{J@j8+k6E`8n>w5-M}k zJOo9xR2OP7Ix{_oJ}M<2mB1I(A1=OpFrshEmzY1H8@!yB#kC=F3er<28%oh)U@;xLHbdqvD%2rVoYD zLoP5x;{yGVL3N2m!=FIIl%%czQp+(aj2Kr~G4c{(bmEKr1sBcd@YP26aw~ixcsxeC z=w?-WMq^dPjG3dytTkdP0i)-yC{0W&m8eeq)p{c?=g;6xi7jqCr>yuMJ$?qMZUcAw za1EkrbAG+L*sLeLv+v8iQD^Q?QOIbrW)mB=Xm2~2! zqSJ8&0(#sABPGlOBPH{a_@xguZUrxf6$KXGt^kG>QZwpnGl05RR@E_fWJp_9;P5zQy`F%&eOxifLW4SDByaTxn$Z#_YjjwMmeK2k$h zi^IdIxbN@2yZ@%}!4qq8D*p=NUA^aC$+^G%V64A=9a5Z+P~1s0#`*wqG>WhLDNl9k z++*oI5=)>Uc*}kC7`Sx}LR6yMcnEHt)rgrcE_clw>mX?CqH4sd#@S8vNJTfEqIe2n zlu$>t>Rmma>+t;$p84HcgbL%{gD?>l`gZj#u7jhh7TVL-LVJ-`PVuG5RWEW;gH%Uw zk09Ng%Nmt~8q}+`NPP%7tHad|7w4RLP>1nQ1pZ;=sgai1dlP1^(|JF$~z^Q6}*Mnv{jc={`o|C5Mtl@F-I%;;?5MT~8 zx-}r1T9aD{AMeaGIM&cI(cr4`%kVKz?MCiHaRiU7UG~b-*Lq&k_C7H0d+&A=omBUi zG}h?ckT(}hVRQ*KI{NN#`7IZq(cV7x{0shz&-MK$dVWKTdlgP6?TsZsqSmJLp+pJd z(UO4zU03s&1L3BFITi+us&es$*bonRYZtFFjiJG>a5M^UnU&{9|<59mC| zxGWfrOdOBLX^9!9!9*RIR!m2nLK=89&1fBK;AY)~0G?92Z9-{URIKt~El~&TSe&zd zRfBOMi}$N>hd!*_VZ+T}9s8}ovkBha3$WV^$9mRj2uxE$nvY^?hYl3P*!OzeH(^A) z9XekZ?WCJ9GVVa@ZNxo@v2Y7~Zh&7CT(xzjTQ(OTX+Cv&{F&#^)DEUeSAt3i7wg=dlK3+dox28k@Ky=El7eO38|3;bMWr| zK1TBRQ`d1g?!+ZXg8n~iK@uR}?Eh<4!#6<^9RFARXN@GBOhOWFD04;6L} zF6?~O2}xk9p<(F#{2K(u!MM#Xh2Joilqt^eV*_Vss2{%Wc-3>wcbt8;>y;;-I-MS8 z2!pnTGcf-D2aSN~2+ojQID_@S`{}rJOd=kOn2uZU3$cXAW=n`QDJ>r6+7cqBGW5ma z7aQSTE%*iZ|H|fG@C(5&_@BTjY~IBZLj7Y5Ekzv(w(Lpx#q#$%;}iS3kJ0_ZVH#bkAzrc-;e(@u*lK>u*Xk#FD z66Oq#AS`{%xd~z?Au}%QEoFK(EmNOyad~hCb7(*KlQ^8=+i>3}ID_B}GUI}0c*u+k zg&~-8<};mf@kA2Nux^Pn&hXEIGYHOrxf@fkNY~e>VB1=2hJwtvux60Rj0>4@F*7@f z?KV3Jo`GS`xX5NZi6^hV+a*j ztxtdY{D1uDX!&8&N#N$r90>q!v>JgU*%ZRBDBXL+pC)^E!WeAobScYI3N$dY* zie=oGgk`*Og)^4%Pl9C#mLXV%KF8g{X2fPfY$h(B&4d${k*wx8 z&IrZ0AQXa7hz*6

2l$bAWfXjo+_RcKsZ}Ty0*lVe(x+YiQJSVYKJ>|Gn|?v$u`c z;657&MUR0{%zW3+BZ5$56+*EeRuqYr5<2Q2yM89Fl_0x*%C4WOcm0eF-UUezBteh_ zY>dJGRnpg+5hOvO2rlwMza?xjUy7?lZ6eRhnVCzP@#1FY5x;9jGLlfU&>2a1QIG^M zQfwW>)Z-uy1HKkc948 zLlQnINJ5q&3Ei+Zh~R%mQ3@+e!9o(EwpkitlOQ$;Vv}IENr(;J1xXMjL68JN65KQo z+AO03d@+hJdq_fesWX!BGeHsrNf4U^u}Kh{1hGjtb$Wb8NW#(Rp}f})U%c+AvNz8y zJ^IH}vwWpUoJ?9F(!0PJNjNV^f*=WkBnXlqNJ91?30;7c3vv0N`|^fFD-^_x zwTJMW%_~H92G{i+8gjLrdho%#g@GqN>Vzb8;y=;DYUj&g%$?{^c8OEpV>2>qt24;@ zk=e8pg{&WG-~XV6_M(mO%&QF|@90C=Uq4ew%eiHDXS_e{2N%-3oru zP4x=H;oWq3N6xUao(a?Kii2D6ZZ`Mrc(3em5mOlizYt3Zv4jvyh}pA*NX9RAlsMxT zKNb8!@C(5&1iujcLhy^3T0*?Gyx`ZXuR4G2Jry@rUHtj_6LXJWd~(+C3t3$>rqh%}=R>LJ6eQ8HQiSP4Oi9*+0C#2o3)%l78&;Qe zvcI_3t=nd>T?V8HoyO`wnub;nku@Jb?Wn~;YJ}|RqD`=C*iM__+DSKI_tg%p5!r}) zkUFUaJ~zOx39j0@(k+{dk2KE|zu3Oy_jUiUu6e`bo8Kw_M(OT}xyLU)F>CWYWbMi9 z!Y^d)NwJd~+vZshCv zs81@FG&SC$A^U7zzI`^|t2o0a+PdoA_ej}wk3P~i?te9SZtii0kIx#;AS+X58_p2F zY6S0gVXY@2D^oVBSsVw^6U%%Iv1dq)GsK4Wf-?xtAUK2I40DMy{A<7&XZT0K8K8ru b(Yj1~1hHo@Z9D{LNQImD5^$4CfHV9*Hi+ZS literal 0 HcmV?d00001 diff --git a/x-pack/winlogbeat/module/security/test/testdata/4817_WindowsSrv2016.evtx b/x-pack/winlogbeat/module/security/test/testdata/4817_WindowsSrv2016.evtx new file mode 100644 index 0000000000000000000000000000000000000000..7dda9113651d5fa4f43e4274230708bf48f58be2 GIT binary patch literal 69632 zcmeI0U2I&%701ury}Q0%+q-rn^AQnn(j+7SJF$ZU!QsRBqog>F8=E8*L13^=oUFZJ zZIeJG6aokdiHb^qka$6r5TdOrs)8s{)uKkN@<4$gK`V;d(mteWK_Yx8h?nL6pL=iC zUX!G0B*epiR(J2t%sDe>e&@`Yv3v4kz2o^&t1OAA;Q-#ACC%!+N|AG}*I!V2>zoJC z03sj)A|L`HAOa#F0wN#+A|L`HAOdG3(32nQ+Bvx!f8&ScRPO`q#yb?;D-UQiRjCrVH9Lk(c`Jn1-r02^nk8F;6R;_|h ztNA~ku=M=%FP}a!{jQhuJgfDN^wMm;s{SiFrT~X(6aw*$q6P8Ek6gpB~yX}P7wC%C0Z8bhqb|+d!Av28M zEqITkrDz4z3N{AG7Ss!9Uu}EQH;H$ft-v1O%S^;lK6bMY8I@G){VYP@uV4Y9A@Qv8T$c-7zVO&EPvdY zKy+E((ur)+(!N(?OVAKU`UTZhwlxwP2dPQ)C9*Z<`|$C_sKg;Y@3osdx| zVHcrtQ52^=`+Xa7zS!+V5}eSpCRDfuSblMF+BU<1bPEx2I*%izY$+=7&e`>5U^k)r zUihs5jw9es(Udj%z&?P=kE0PgepG`=#~sryh>pSlx@ZJ44i9$`V`{_x%p4EKO2Cu0 zhNPE4w3Ks6Z?bL{?JXFPCexCTd?K5%3~hNBN^wH?$tN||<-}-5-dPf3-2u7Y-e`ws zj%TbBBTmC`M$0r-8jhQ-vRs-;fo^aALxXYZa3rqj6iRgrmr`j0bHqvH*DqIN0sEZc zGj5{Ly*JVhc++T0=Finp%-#vXDSRR;0t?bit#s|f>jMzp8L^E4WUDPmdi5@xn2cE- zM2L1lau|U$>FlP{>do`LQfWH`nAPaGj>*7*nm{PfxNxr|Qr<$_1{3t%&V)aM2J}HHhyPP$>W*qn&=Z0mH`$`q`EMGIZGttPb&-T>^=8oU6zB(snb} z%bBA!*V=-lpKY+kzI_Lx2ut@MigB2QD-5jB0&B2(%b_=LPhc4*2NhR(QDZ-rZRh)o z+17rP1EMq?D8BmF*O@a{UH+%PKY*OK)4kvI0=WA_oR?$2jk4<|*gZFyHG>V4*a+6W z7p6DQTVpfgV+Q?PF(vP^Wludcv~TE%jn5srwj;UXa9t&pFm?Zg|2lYL z>-!C#FMIj5OZLNm^+i8@$I-Sv^~W#w5L zDs;QSlE(*WmGu*${@O_YG*Sy$L5QN*g4^F?sm!90=#}FqheVDNmha>m<9q?5i zv$3TMJ-zT;9##$FO0WWLH(Q76>p*W80*^9XXxWB5I)Lv1v<;zcGg`Nxy&K&i z2Q$nR-tjGsk_C*l3}ei0Ukf+Uz8SRkJBjeZ#N&jilN-7PGw}E{YpTW9^>|?2?FdTV zgX{6Wx`}OO2Y%!82#A0Ph=2%)fCz|y2#A0Ph=2%)fCz|y2#A0Ph=2%)fCz|y2#A0Ph=2%)fCz|y z2#A0Ph=2%)fCz|y2#A0Ph=2%)fCz|y2#A0Ph=2%)fCz|y2#A0Ph=2%)fCz|y2#A0P zh=2%)fCz|y2#A0Ph=2%)fCz|y2#A0Ph=2%)fCz|y2#A0Ph=2%)fCz|y2#A0Ph=2%) zfCz|y2#A0Ph=2%)fCz|y2#A0Ph=2%)fCz|y2#A0Ph=2%)fCz|y2#A0Ph=2%)fCz|y z2#A0Ph=2%)fCz|y2#A0Ph=2%)fCz|y2#A0Ph=2%)fCz|y2#A0Ph=2%)fCz|y2#A0P zh=2%)fCz|y2#A0Ph=2%)fCz|y2#A0Ph=2%)fCz|y2#A0Ph=2%)fCz|y2#A0Ph=2%) zfCz|y2#A0Ph=2%)fCz|y2#A0Ph=2%)fCz|y2#A0Ph=2%)fCz|y2#A0Ph`^Z%j9bAb gZP@Zw>pk|u^1Zj#nE6n9$UM6dPrc<(58{Eo0{#d_LjV8( literal 0 HcmV?d00001 diff --git a/x-pack/winlogbeat/module/security/test/testdata/4902_WindowsSrv2016.evtx b/x-pack/winlogbeat/module/security/test/testdata/4902_WindowsSrv2016.evtx new file mode 100644 index 0000000000000000000000000000000000000000..695eae2bb3bd58c67f3612dcb789524337ef1370 GIT binary patch literal 69632 zcmeI0X>3$g6vxk-c{80(+nE-uB7&BkqAi;cSyZ-`y;fQQV~tj(h0=BgX$w^nQ&BWA zQE?+Ags2!q#06uFgqTPqCVU_u#3d49;wSe7l|V3Y{Ga>YW!j;LNHj6|-^qLLF6Z5Q z?(Z!3wG}Oml}#-Tl3fCRM;D%s1Vsv+Y>`WD7xqhkbjg!&0umqr5+DH*AOR8}0TLhq z5+DH*Ab|@KsAy@Nxgyz&zwy0tzGs&X7CD_G z@@q)sYq$G|ND0=x5&wp`*mCFs?`+4KS_WcGEvJ0>1Af2uZ9!jSmOeM5ecJygN&l=h zTK&27-JO1YA!I8t=iaP&RK}Jg*!#a-hTDJa_zR611)D-IYxkO^)q$TnK6T=bBl*r( zRU`Jb5R!mV3WKGz9lTks@#asyoVnGSJPM!=#hxPP+xjC}f z7i$8kB*p@ss{IRP)Pxy zdb`?T2Bx)=j^Er{?LJO-Jwb@mtmV8uI;RScJB7QH%$qS z++UDQ!AsT0b3U1G4-l;%oc&_W(aY9sefrJ)-*1DaDg}#eLRHULEwk3EJK0n{%eZzu z`ZWtq!m|Wtu6osDDHoYZLr_Pr#1+=;7jiT?YHrf_=zy;65-1RfsOif5_ltR*oZK;EEW*e+7%V2eI(kf7^MGCBhpLvPj%V^D*;jczZ@aAm1TZMPmAPmZJ zUX{yu+{Ysnlz5HYZUUhKnrP8VlqLuD zCohLPp8g-ZS)>&fia>Ph$s;^$n`ka4hw0KLYx|_q(4@ zb}!yXgH6C1P`!Gk70-C3@5354>cg6r{H0ukk1D>x1dQ?YQeWz-j8t#AKTr_xg0fc~ zR8@sxlWL$K2x%Ag7kH@yPuHyJ<;A}jA-CZKNElrkfPA%YR{hHI(Cb=t$ka6$y$jDy z91Qw}*KCY_7jjJ#QsXL^rXDFmWEfhRuQZiRVXk4AqkI2&dTRk8@H#ILmM^#*+Xy9qvoGRbz)t}`1^g87 zQ@~FFKLz|0@KeA~0Y3%&6!25PPXRv#E|>xX@^kx7Ex3j5@k5Jgy@YpDqrkCvrHaQ~ z{&48%i~rAdk{|owYx@-%#wisHDs?7Ssgp7GJxaBw&wEod#7|ugU*McAWRsVMWRsWg z@V=iVnUgcuWQtB!+ z?8xb@S`kx9TX1i1@6sFoG5eiB^*}%+1WpWVaS&(l_VQk>N8Z|@M)2+Ur(15PZ^B3Q zt)Vv3CVxR*_9n!t0cwuQQ3a}q-rqy7xM{NU#p-mY3D535gX{DrqW?WYKH2m z+R@)EHJLuip<^b}c3WEK(I+!iA-yY9xpZV(dS6JNw^MUzUjeN* zip)446R4`1(g(=tbuX);M$2J& zlu`w>FDkLBiish{$@B(UJo|908cGK;t9m3 zKOH%dGE#x1o1rDCKun;dWGo%PQH{a%DhOH$HJ!2oiwpTmRBWK08bcC>sWz$~Wy~~k z)S>jg1O4wndAlni%AjwRPXF6dsuWTZa&Bi1{pj)t&>PzZ=@>>fn^cFASE)vHL>yvu z?$9_jioP#fmhYUPYDLE+)=*7iR82aRvZeK+Tug;o=oaCfKIkG&=Q zrIGIP!K@9X4F|Do`rdO%dYkjUV;jmJvuQtnV?J_5T(-P0h9VWaB=2obuQ-l|v4KQVKU+;w(=1L!r7+S-dA5qGrc^D)+C{Eq zxpL^t>V`8BS);0vT0XajoO?}~)fyGfO`){p;)7GG?EI+E`JLqaf1-LQoj-+M1(b6EY2C~IXRJtVQj|Abs%Q-9@E;$_g>|Dlj za?z4}Zu5kjT;&3bN@aa?mb7PCIznHKxj^a(6i2Q(8VoSJh*zlvragK}5Ka#~_sbk0nxImewxtRQeZw2Pq{UcL2 ze9&OY=gx7^`3EeTI6#@FIfUyUR=vYsevB6`cYLwpv~yf^{sD`oxCLdN=3?>>i-X-i zZWazt_FC~mrmOWUSTu2fGEZ{|*FUUw0=s`q5H8;w-n8F2E;|2!MH3e&^E8*R{Ub{_ zM4wvpk#ih$n6C$0TxZ=2b5J#4&28B4(t~> z!r|4yx!auMpo>$mXyO26p5_p4oU+Cj*yB{LaM>Bt>g_C7{R0;FjoWwKfTPX(zF1@Y zm~IEMQxT`2%+p*mO58V>QC=A5(?P zk-NLTIK@@}fJIaN3d%gq#pEB{nHdHD;B}sGSTbqWU-De#0E;FLP*y29SpAORzwzwh*P}2Mf~Hy;^9|KbId<fBqhTpLvW-WQ zO{49Gw3cyf@uefUczi66xhtX(kUV}Zjz?MX=qf&=M%fuBV(UJC|=dY4Qy$>in68H$RK5wH1dZ23J%rbV!ePweM`rDH%zt$pU{UA4 zduVVSlvP>|xpodSgu|qQ`{ujL0Ty-sa5d!+D2ogZw+e^iBlDNP=&C=!qK*Um1C&Ju zhnd3R*6r(7yUPIimH@Kv`sPm@ORsyCl@GX@OP!<^+<_L#QtNVQEu0Oz{i35~H28X%Ap~sg8 zUjD+>@&Oig9EUX4zOtA0A-QE zVS#YC>CBsNxa$wFh`2O^+R=F7{&NEuuDg{$+9s+2Cm%c%)1w^$&2Xd_Vdn-UND0rYR5d=rutt zq?Y;~G{ZqRl}fJ;^lC$|{&aRn+UiU{{%ucZ@o)P3(RLTw>O|X}X@6%rBedOx_H1)dTE1d7p-oIG#-|QVu=09CKGc20&AC!3_|Dm5K{PzBov>u29yuM91#Q)K44zOtA z0A-bwgY{cZbE$`L2OKHBSPa$1htyXXaFp5)L> zdLnC5T$?3Reat8~KMT)Tf>}0V>FZL5ANsR-%`uCYK}BwJfkhJ+D2qHU9JlTeE{n!w zH*wBibma#u>bPvDoC0N@M> zGWf&js%@O(Fj-T6EE0<*4p8Pv4*jJ3XhOAPuA%chXN9UUy_-!VT0--Pg=Vv&@y*th zT|CECA=QU@bWCXSuv{v4ta0gFj?lij%!|u?Uf(I)PGq{x4Hiw@pv>o{<93&Ddw$U$ zT=2J>=9P_egGCcJDD%1LxZN$>niadj%|1R67ERos%;%=#c8_pdz0z%NuxR22Wj;3@ zw_@QoaK#Z9;-uZ*V9~@4%6x7*ZubheItx#@%ncTG+_-%h%6x7*Zp($+{7ENW<_3!< zZcyfP({Z~`xb zr{TQ$kRK2ZYwC2I?;Ho+@6cgUlK(soQ08e4;m!|Waak+v_v|0P5-z!`A7A^OWB!4D zNPE2<7Hbn27Lg@@*gsCvI9n+51ec#aj-^PoLqFs(;_#qwXsI?k$YG`Qe~q74)*cUw zIu7e?$~?gViBZ~0m?kVx1yi@tno4I ze`|zGqq^NUpL0C^+3R(%hU!c@Fmb7+5rMfU?TUA*z%E`^5&~aC%uwddzLb=R`aC zTtrv|hvGArUyu71Zr6k|PjE1`YlhpNruN*K(Uy6H9`=gobYH6U*Nsc)nlx9lc^DXLut0x%}qmQsVbtmwvo5rOO^lC5%^&lhmo7Kgvo) z_qf5Li5ryp+$a;%QpSz_tBP>Td~M+Z&i&4C)Ab*~qK?~#qzcMB!HwhHyEG{z2aAh& z4(xf)Qw$21YVTk1*Y%EZ(eGpcrWy0aXn3LbT z%K;Wm{sCo`p99CKc;WEXu-Z3naLgZcaS9eq9H7k89Kx=bRebJiRpGKfX6F6QanZ#o zSTu2gGEZ|c#wq52IK}>vARIO~*|_63uKEWo);V(JjDdgsX!zEL-+1?U`n^q1UO<_r zIfU&Witg)~2iJ?456ysWE$MG=+U*<{oqxch$v>dX(_D=Hv4GMZ{=w@+;jlILlXH(d z<{vr^uvn8i&RIlOC_`9PMXpalS>@!g(8huNqPlQcQ*YSfO^$KUmE*8D`1XVz=}){e zWMB5DKdgM>+bW1tQ08e4;l?TJJ`Zt<*Gan;~qG{q?>i%c#xgv)_vm#y0D zs=vUZi3^lP9v3c8Y6_QaH#cv8$T2P$-)HYr@U~#$;|TO zTWSdhwPVn5cR9eK&Oew#sj>iN7g}Pu@jA_#VQnVO_Fz3xie`eK=j705{KOQR0fIiI zaU*n8Kbli5pFX#qZ=_xsXFU&kz?M-7lUfvXTpZq2rmIQiuF{U)70T=s)_7HGzBih; zMI{7&ItS8guV4K_I2`JEBEOld=`4Ej!sYrQnz;$eDycuvxO_W@+QQ*T zx4pNz%K;X3{=gidtdepdF9rv$Pt_3)FZ6rnp%#w$gRY(ni?zuESVR`RctJfE$~?j0 z=eDa`anoMUyXFFHq)bF2?pN71Q( z5H2e|?OCh4t6X5wRGvUtL~t3_;^0+L;KJjy8w!_K$F+{{?HCu`_Ff6YgTe*3 z1Mqy*Q07Svmwr4ev0`2r&)P(|1zWq#4Hiw@pv>n+nOO1DMZk^g8BK-Tj>YR5I_Gb? z-+#d(J*md>w=7Fu$lrK=LMZbjw~P5bcxkh@v(b8OM1Nvmrv|3Q07T4m%enMDgc7z>J?WBw>2Z(<_3!?joUk*%;%=#c8zd*X0O}aV9~@4%6x7*Zmoq|tpjdwv)4;t(ZmhPd~P~! zZG_vtqi%D9MH4qD^SSA`wH0nlHoWaZ`DXVwSk!Uj{!1wHxmD!G{gds4+m3|c_g&{| zzcVaOQECbe3qP;l8Ol7t?ccWFxxMh6ndl^6UB5Fdn)pJQC-`1OzjN(!{mvbP!?^lx zbAUw?2Pmto9Nt=l{(o*C?kF5SioSW1bMa2sUImLhFEY2~lMqV_+V!E#lN>I6yMCUU zY;V`^B-~cka+@10nz%uk&n;BH$ST*a-&weg8q;Zu^ZsUU_kcwcHz@PDS={J%cXog4 zBHRW|a)X<_J`al~ZcyfPv$!>gf8Nfmt8m+v<2E-~G;xD6pPR+a_PnRHR4?f!+#daE zl!I|nH$DdzP28Z&liV(5d`=$oz;iUZ3zvRsw98yz(ZmJHB8JQJ;KK2)hj2MGaFK&t zboF>xq!x>h&XSTW%bi1YdTwumGEZ{3^!4}(kESk7Mna@qf?ONe>ZQGJ3-M#;U#e?hTS#k2c zQ%}9QlO(dgah!xQpPPMHzQa$B-`DXVwSk!Ujar#i^bF0XW`(yeFx9RPsKHAr@ zerMhM8L+71_93Z)GEZ!hbKf{_|4gFz!Kiy9_B>y=3b>}$f=4pV%+A5&pD2vRn zvPr0Z$Q+=|(;R-n{29*%(7wUz{=(&%R;QYzIOZQZF0dG{qOA_ftO{J9EJC=%{NHvv zmlWah>($lj40M$XESlmLltl;^+k7(|&jtvWt*f>sJI6&=p1`8GN$HC3b2*MdnWwp! z$`kAPEcWt*W;d{w1x@}V-8l}rxCM))0AvFkpv==8!Y)sCkWV0PF`t3L<^AO^k9CfV z&Ocx=@mGHunUVQ;+OnA=KHh&vg8;ZdnWwoJ{bMJkJ^X{$gM>r9p)DSAmjf)C$`2^3 zoE&!9IIv#~77pE7FMG^64!Sr6izW_G=4lRL$EoLt1>zL1e<@s+Tyf;pL9W)XU{Tkv z$K^PbMFyAWD{vViTpsDPbmL%Gxxk{yU!W`^xa26BN6GFlLxs!oN0uJ=rK?X-?sORa~yQ_VpueB zfHF^W2)ABbZhn5|bAxahT)6vt=eX$n0~Sr?36y!7i^)IA^_MV*k%&|OtCkIOto+b% zNE3@D4p3GpIZ&z>e~UQ9>vZ9;_w}NE!(HV7i=RK%{@4%6i&7phtbbtLvYeJ^&w{c_ s$$^4%*V6VZE-x~KL&^ABe{_z6uDpOn69*{sG>34@3#-s%9^o$k4JT{->m~mnBee+zorTFer|+kx;iB&MuD~QN^M&7 z)q&8_m;aybwC=W{x&0gJ$0`*Ur_|XPrA`Iydz5NVpZBI_h)Z3LUgVsuWRsWrWRsU4 z5a)O}5kM*i`z?{pG%gkGY)XM5W6)OR45) z*pbs)wIZgJw%~qm@v_1HnDuU;Y9OEz0w;&GID#{HdwH+c!|&`+E$*H8=UVQdU&2TA zsirp4CjUTQ_9w)s6g69At9(^R?;oI7>{Qu#plXbotEQO`=b->6i($-Imt5^vMiWK<^4v4jtK+-WSm4?bICFmrv`Csy+R6rmgm>JN?ft zF+a1+yQn~M@fl(TZUq^!DqYQ^Z!WYfQU>o+Ts($!f#|mj;?yw9`fRe5MMuq`y* zip)4@O;8OXvD0X$Qi+Kw5Ib7(L(7^$)nCoB&ZJ#cRn_P|(JGA&n=eP4n^4J?SOZlu z?Q21=Sk7|%H7$?Dt6S(RCQy>)($CMeByiFt232fSVzi141}dv2^Z{~u?W-!Ok#blr zrBpuci%P7lf3fZiaBXB~}EgXutKm1iBK_@F3NkKWXie44T#s4^@TcUXr+vB7|9 zL~qyyczK~gtQtxH84D*7n+xza#i*wA2A(tZ4{>S`?Vd;63Md`3DBbzc7*#V!$v%wU zJR;xNYgJ`3nro$LKRPs<1Tdm3I>t&K_9D(xH!O%RLl7rX^2DlY(Sdl%Ev2y}HM)u| zwTIIevSd~gO8Kb7coolD?xT|s5H^2TS@p9HV;y;x5+v(bIxaO;JUsr}c-4o#v5Hwd1d+WjUPV7(t|feyWhjJq z0P7%{inYYQca`MXNp#>$`V$p#DlV2oE2F)yM;xW_6iHhoK;l&@E;^88WhV~Cyey?G z+K-N$Kp83D(#_D4R3I2AE*?z>a8zS(z4GI%gqlWKfyISN~iyADOCz62|2ejhraan2+$kb#?dj1Y!;~wC9hHq>4;dw z>YTx`Y6SgWwk*FnLDh&3CRS68gQ_|mO4-tSQ7)#!Ec6TGR81A9s;MMZmG;J2uQ(NN z9Y?2FODetN{q(cdzNp6hS(lbILi-vmjwwp9V&;7XyN{iorPM3d`rSYh;qFeazxI~! zmqxnF2D3JlHXOvV=y%T{>1{6fjcq7@%%c7Li}}dOs@dcBX3WiaY~a@YH};CY?v*O# zQzaC-qkc1J!U-uPc>BR$``mcU3SHNv`%BM`k zs-r^zN~^k*O*);yIg_2P)GB2+R^36YUR$c#9*XSehHOeuY$@l}Ej{l-=VpzuDv9m1 zk>f452&HW0a>1ZfTP4!Q8D1&!64i*ZcAWL9scOrbU4zn1QC8t4hF$2N`*PC~Up`4W zf|r5xmrnUQjj~n-<>kKgN~i563ph(Dl_hS((!~$BK0?P#qny-_A_13qT$gBPg_lqi zDjQ}K0@*h{^Ics!jp9&=6SIT!FJbY`qSTQD;*vqXvk&FV3^jnttl^|BLvevmOHi$) zBdz)ntw)K=cC4|Yary=IAzdut6G~%AsSLytPGnxXk|2&H!)V<{HRejS8a6keZswhI z8Z0h*zrm6%TRyyb*_M{~cKd3`-Tc!&qJyEV43+RAOB$uVJw;y~vtn(%_?J?)j!2l; zBERFJ@V>=OF4-LW>|923a?#S@{Fd>zxyl6=mCF3&9OaNqO9yifae=Z3;X)-AxGba8 z7$aP=$J{#EIW8SE{sN1FqhtjxQ08ea9GNMVtvJRN@=$$AQE5Z90#1L#ty_gdqn$-B zILAR3w_x$e`ni^Wynp)Hw|0?aaDXyTa|pXUp~`kidBS{dL)`lA&wHKYqVtaiVzImOFV!(M)j6E63Bwc?C( zTy*{ci>9~*WuE3@@(+uH-9K&@4$t&jv2U!a^($C3aey*Ua|qWztabvse~cF{-yPk2 z$T==L|A0jk7bx>Im$3aKQ#eGQUigV~9CYOeESfk#nWs5~>mL`C9}|SjnU~j|a*m76 zKVZ>xT?l2K=3?>>t6RoieoPb&QR5DscaDS3KVZ?s0m?khAzc3;3U37L<;Nu9(xu7E zQR5sd*LD5@iz(MGZ`$md-=}TfxG8zue~r8o*B?;kX)Y%Jp!SNOf`9NjOE_$PGJ4&3 zS2@6DhJ*5^RAaih8&&Pqj`f-+BYF~uqFwF=t(W3q6V`QpG2o#UYM4_GvD zfHF^W2-iO*t43;=-9M%Xmt*&LJuul-|A0kP{R+xF&Bf#&+?g2#|KN45a9BKX<{xui zg(nd5BZIzC--u@S>s3 zr#j{zIxetis$W4_L~yZ2PT0BR373I~-l;#$RW7h-;sRw6!KIK!#Eb%$?!;u8a9Mq3 z>G9=`aXDdKk1BQR+|uzTu&9e;*O4bfnJ2jH-S*7f_jt@FExg@x*o;xH57_hIq8c&3 zd7M6zQE$s>vo8%7;*o7Ul58q%*Qd3NV~Z~t!NucadCXlQjez9wYq31aibq%R8P!V9 zC>;Y_GE$94nDJ3pmmXD##vA3(i^n--(>TtkDp4wq#$Z{s3mUCdo%;BBL>3RjV~gB- z$zv`HX<&0Ge^}!lIlpj!KbM2~l5d_{RO^g$`KFU5-@u~IpJ{kgi84>+oA61{cumwp zcwHbIMjd@(=6=WgSH}Ssb^g0Iu~b=w<&b0NFkLuI%ztQ}yBuIq=MUFW4uP`B;BcpK zSaxjQ@&m5=11#z|us=XqWN?@v9PZq)Zne7{V9~?@$|8fqOyQ6oO#Ji%SN#DNb>%|_ z4M~Qw$ly>Y9HvYf^trnnU{U7}%mKzEO`tU1XxmrHJqON@4N#CF>GC0f?4qvv)C~}trEb9D$%Lgcn z3=Z>zLzfP_UFHCbCJs;*864&dhuhA+^`^W20E>uA)2SVe7w(VexCCX9!C`@Lxc}2v z?)%!+@&Oig{=gidtb%f&yI#@0w3rwy6b`3;U8UMLj&W!a;BjM0jkUGY!{W;Ub%c_= z%>9RZ={=Nrg2Nx4eerL1r;=(~c)Mud7h^u&H|kc35KkjVSw%Kc2`E_T9+V6u_dpqAjTu5#5J=Ivc;hks7;Booc^lk|K zFQmI^Gt_u`O`<6ea_Kc*EufbA9yG&2Hzi zwmQ*vXWHMH&IoOHp*>yIBKny!{|e_jwD&KP{5NZ-llf2A&J2sD{0C*8$baZ33ctNS zIjslc0I%;74)MQpn*%JGI6zqi!;j(a4R%7Sk9?c`Xu zxxu1|8%Zcd3vtr!Z?I_M24y}s9k&OCTdf5rUFHUhI&R!P z3}rqy9k=DeZQjIFE^~uL6E`UHx#_q)B;0zm-r3Ii>oo{vJi+DC$Fb0J6wnX(F>!cQ zIJ8t-9OST4`oG4_Ep3m7MIDFrHf5gRfbndcn*ZuiV^Pc%<6|BZzBSftbC55_$JqT0 z7Il2N{s3j3;9K6$e$x0D_P;g4rD5&vTh2Qk|LpZTSVX;U^!JBv#JDAne^BO0E*Bq% zK@X8b{NwfG!r@%+>QB4N0Tw?TzkTzM=X(uawP8nA(*CoIRRTuy@v$HgZR z54W%0>Tdm@NG$5O+(4?J%#&O$UQeT2U{EgcdcAPC>yg4|oabP_j)6rJ2Pmtk9HL4% zuwQHt4ri9Oq{rNre@?WM&qahqa9DQs>YH)h!tI(+<_Qj_cFl0x)70L3Gukqb(8FHw zobD@?{<`tXY;j59yMc!rHA#PjET1~P=Z^7o9naS*zou7=+t^ zQ@ZS>RKj@WSV^6_c_XY;bdMV>nz%uk&y6xMEv4MpzbXm0v9B+f&$-_jZo2*hSk!U* zh*UwDC%AFEdygiC{t;|CIGG&8*8gqd% zPjfN#uUXGZx7W+A5)O|BPyOgF2Us-u2b5KO4jiZAg~K;PYTmlRF@Mm-DOfadfHF^W z2)kZZK2B8@E{B3M9(In4E>6Lsi3^l@nu{?`F$csc_KyVNu%+?Fo&Vvgf52j`W7kga z|EEueZhQRA_fDig*cjynlzEy%*#4pDx}JG(y_osX4A|C^{?_I_&T-NC2P~TW1Ij$j z#poaNDed7OyiODj+j2fTzsWKG&~bpp>eO-0A~Hi6!m28AeG1AdCWi$!4(u0Ig~OUU zLl$jzjDxNmhsA++C-g{v`qe=Pvp)aJ%BR1tgg6Cdp5_p4oU*R-5T|&ZBwQZ){GM~} za)CutoPx5*xoh{69hdchd$#crqB!!^eK%Sp`-fJoN9UWx%GS__39YwdC)0aM7Dqc;7Nj zO)T>*?dV;B%uZpASGDGQqj_6YLg3OlkY0QJ>Sw~CsOQPNrml|ng2gzhQE^IV(u)@^ z*NbT8CMc_*{y^jM?Hphk_WJeOnUKxdM=cCg2PX3SGVG(y`FouaCzWt+cDR>$^{lfG%n-`H4mkTWF;uc?@Ls>*{q0AXmGH#3G*)_uD>c5Zb*UmA2(Y2evqRC&N%+p+q z?N=(;4KoN`%t(U5;OMh086)@Bh84WB#Gz z0*ktOFUKt?iwrI`sXxSCp41aAD?aa8qr0nIV9`{bKv_g^8PeiN^C)oPaoY8T%WGp= z$M<%Oi*EcqET%@OWD-)QUd;DvL76AG@c8@j)S$qr`LDhoPhtE$msbsh@BZ7I%RwmRJc->Gq%+Gb311y?2Kv@OlU~8Y;OB@;rhu>a1xsG%3PB)$v z7L%54A32g#OgVGYp?^@g;C29>j~dE6$>GY6XC+q53*%WE3%9t|ZgYc06E`UHxltxo z{B#j;<9bFD;kI+py86!fo9_NESfnS_SpJr2$qV@#&rb+tp5%5p_k)+z`vXa|;y!ab@Zi&4t^V;cjz-MH4qD z^SSA`wGeJkcT8&FT)hHu((Z4tXyOKCJ~th=>x5g|M}OurH&`@rgEF6+j$2FN*6eAw zxxu1|8A1BOZi_d(<3jmn_cvJ7apV3= zDD%0M=f?e$?S$LTgrN`JGc20; zLYXJ{UPixj%`*MY9fZS}x^8oTMH2@otEe2_UWopGZXfO_96pJ@eY11%PS;)qi##tf zx8;)%OAFfdq0EyUu6(czig=hjuYZO?X_8!Vc* zL7C6Z;%0l^(^{&RbQ5k*elxeK_`Tpr=-`YhI+21%$LYdD^$E~+;o73HGZm?+L24y}s9k&~W z+gp9y;AX#WhD8%MDD%1LxZNb&cBQ(_4Hiw@pv>o{<94%fTeDI<>wNiU_cvJ7apQ6N zQ08+h&yD+I`Utma?WR20$FY8A-TWD_sN?n#se&?3a5K#VWST$2nqLk5VSGK^S2#5I z+pIU76(L&T-NC2P`K3;`hTd#%@YmI%C+UhwiBt02e6pG#8_P?4qMX%1n>sTYX_ z;uNocE?gF0bL_PNuGX($QP;1><3Lxrz@o`tpe!P|WGk9S z$?h+Mh0F3MmK^@Mt6X5w#0APCgbU3|Z|9OGTs~aa{LMkGa)Ct?7buGeF4lMkJC`BC z<@xo$dLzwMF0g1SU!W`^xLD6w02i(o4;3zHjb{JRIWD^E6Ie7|H$s`GxtOj`tfy?? z`hC4f$~?`* z35t-McAq0YMBBH<|5+K1Qw3`%l+XXBs6{1k6`Obas#rDK? zTOwF}cXZ#of6l$<+}}C(yu<^g$$YU?Kz&I>1B-lnNCK^1y~thnTemE|cGsI|0}&7b z5fA|p5CIVo0TB=Z5fA|p5P=URFi@K8J6oRS|MA1}LGMMI<{t%~4uGD0Ki?Qi|MySR zb89;Do0U6kPXq660NzOffA&|-06FUYJpT;wam&pQS@Q~YTG>vWR{kEz|1KK0u@^Wt zS!d6~?7tiRk>uVw9W&8hw)V$S`zU4e-1BajI-U%cab9%%(6F&NlJFJ zKg;pGxX8IO-=D&R{OxD!L41bK!fo|)t9l7DhLb=x3om^liibVzJ|0EQt>jb-T9Um< z9HrQkk;LD|H>`kl82y~v&6>85vu*agnZXyi#W;}_dHkX?!O&%Wq!ZaB(!SS-9UO=w zeM`dzJRXS^Nvh1bM79yWPaogMP8{MBH&Zx5LGx9~3BiOC*v8JbC{711`51G)n06uw zQ|KYbj$HvOKf5oDV|1Xo#Sob~&vr`T0e0e>bM6lT9^>=^{WeRE6Xb59DYW~ahS;)L+>UmMZq#LSM8vn0lPigNjUbi*@mXVA+Xt2ErArOK0r`(`(w zC2dK;+An0JQPoTAXZgJuW439}{hMne>{ zXDB$wUt~pqAZ@ADTzmPm0STXt*v0^|4G5B6s|zPf##X+@5bdMnI0LEd>^7&h!t=eQ zr4tmetY(huDF+VJ3`4<;3-3xI<=u-XXu=S>@CXC*C@<;}_V@9*kFkA_E*j&hM)~X} zm02RRXg5DR!tLV({Ze;88FN{UR)=_j`zeu*bM@qrG>-GUra3xu6E-FNY#Ta!*e8o& z=_;d`AG7d;0ooCujk64YwyXxoI5{`SN1nY_w6J>kB|2>QKH3lGX&zd6A}e-EpQa#zT$sc0!Y!!p`q~eQbX0JBMGn{)L|8 zCw|>rPa#az^H)#ru;gy(+S<=->o~dh7vJ*#{oeSAr)jB4(PK}sY2R2Y{a>|kic@vJ z3+-`^TNWJUJI8OXMb(vApP9+7pv``oHEr21<+an{6%NiZK914WWy|v%Ez*mR^IhV3 z3P>~qfp7Rj%poFYlzo5j43$|~&!~qvf0c4S;)2yixi|=oYIH~|?he`wh?BD!;8|4d ziFVn_cXW^j#*2M%rYJwmca;Z9G!vM~cSZ8+=osT&Kkp8iSVzaGBUs^cSw6Xr4oeJ{ zp=v~1U2zUVBuF|2gTz^8-NCwr^&snVIw>GWzZKmjx4dMzZh>QYS{i=K?4)5b%hgev z!_Mg1_LI#Bd#AW_Ki7`3b!T9AQ_A)v{cIofud??Hy)2rU`INm@C?71ii#GhL?_{5+rm zuz&yj(F6XqnK)T~u&W{e{_TJNJU3PBvI}(&XXs1DLY|&clH6{WgAOa#F0wN#+A|L`HAOa#F0wN#+A|L`HAOa#F0wN#+ zA|L`HAOa#F0wN#+A|L`HAOa#F0wN#+A|L`HAOa#F0wN#+A|L`HAOa#F0wN#+A|L`H zAOa#F0wN#+A|L`HAOa#F0wN#+A|L`HAOa#F0wN#+A|L`HAOa#F0wN#+A|L`HAOa#F z0wN#+A|L`HAOa#F0wN#+A|L`HAOa#F0wN#+A|L`HAOa#F0wN#+A|L`HAOa#F0wN#+ zA|L`HAOa#F0wN#+A|L`HAOa#F0wN#+A|L`HAOa#F0wN#+A|L`HAOa#F0wN#+A|L`H zAOa#F0wN#+A|L`HAOa#F0wN#+A|L`HAOa#F0wN#+A|L`HAOa#F0wN#+A|L`HAOa#F z0wN#+A|L`HAOa#F0wN#+A|L`HAOa#F0wN#+A|L`HAOa#F0wN#+A|L`HAOa#F0wN#+ zA|L`HAOa#F0&5Xy_d4Kn;__A;3g;IW&)xsSf%j{-JU?E8CqQCtj$%~uJCz;@^+FEH7~evlLOm(u^)KN13Ei_8+`vWqPOv_kZK6- zxv65;t^{xo7kTu6)dbSFYk+nHXyYt66Sx{65BiY|12)*@8eDHomKboy^nSu2Wju^@)Ykk_w8lW+U>jG xV!fZO3R^a2JnRYnN^_YjRC#l6ASM=`^Eexi@Lj zn|ot^w3!v{+{U1YD5wl3SO@z0?lC=>ZdSme*44(H^l#Xy?&WFFJMo-HegS^{%PgU z+J5bO4t?V#`aFR41^Z8ubtQXD+qHD=4{g04vPrCYreqzJxsvNmaJrJ~cK;tcc5-7Q zd|ILZ(`ZKhCqVul7FSaJ!H>0N-PQwzF>PpB-RMkMe z&Qyk_M~+BFax#zhGboWMJNQaGEQ>NNSq#o$AndfuA&AY(jNB_N_|3@}dNPn1MZFo% zN%YK09<98LL$Vp|Jo;PYD8_Pl-Ywhk+m6~c*@1gzY5Tbqt$DR;32SN2!)(D9T1!O%M z>usF&91F>i@x@^y63`7DsYgSPfL2{8;6qe0s_$O!Tx328P@Z<1X z9vsu)uA*V74FUT;G`?k5?EFRrHk~v~cSAG-1=K}p$QV3&iZrHn9gD8;pg#$CB9aI? zQAA5Imn4H#%V-Z`K~-5b@yG{aQHiQ9Ph*mw5T1X(LUtQ5)gx;(@v)9TE}66^Jo;W# zy0GFr6xV2(ho#=Su`-EAG%2Xt+kc%9-P&78ZCYbem4-{9FpWL@B=XYF%3;8wQGCH{ za=QcLQbJ@00NrT)N!3T*MOQvD5!GYSqX%lbutVU2Bb+IL}2#gp!T8N zihCkNpn?WTHgc|MYhX=8|pP)}RyO2?rEkJ7zugGnXi1@jBye}gAVXy9N zZLXA>U?`T5O(D4nq6kY<5XE?zc^0}-E3PCkittBGiz`thXF739qE#(%6i4=kH)(hK zoi*NQ{qes&b><$;nSdbA;*g!c&!)S6=(#d^HGzdDtu*XB3RRmfvZ)F2uz+#3P$eg1 z%Xgm|S{(ZJo)^yC-x<8)S5>7Hyj0!ssdrxUUkX}(qU?dsfBCHwH>X~FxaKtUQ7L%r zB&zz3)vNn!8cu$y?lz%4ihj+4J$TmRovTrGA|FC#(j%y&TTmjJ{lZQR+AqjsGG+WS zzXU%8&C?RVr$UXovE8m^j;=Q|zQ#;HlLo4wtHH5S< zgPDP<@JF0cv?=1vP>#CCEyX=t=>-9et1Q;`>?o6J)kyVMX$@CvM;IDqA)7Mxy56d* z$_-$(qgJlmlWVZ+-CA7l;)J6dqu%~aR^A*{&-)c6394ve1@;I@C8pryO1(G&?NDmX z(bM|#wylR*kEM=Xz!TxES6GkvrSr|^rF?S^QLI<#iAo}tl;duEl#G;|*bzwUC&Mrp z4kLSQzer-AIolc=Df20l#abhXlUC%nZK(BQJdJasJItZ2Z-Z&{Y0A`hfuFY59%)7d z&0&pJ*;Vdaa4+T#qU@17aNjST*u4vcx=`zeC4DG^;I8)+dWKDT2&4MbR)f4&?X9-D z-CpKO;r)|>*80VhHufJx?czM=eVi5ZoR^mM#W-e8>I5v%gfb?F<)E~|mdEgY(}oYY zcC0#zwcE_<89dt|(F%6TuNk%N=-Y{+^&R-NVLWF}a0az|z%h;9?O0KtcjKqCJ5Y9@ zHUj@o!eV{(ABOBK*2$Q+s%O3V9=26JNPq-LfCNZ@1W14cNPq-LfCNZ@1W14cNPq-L zfCNZ@1W14cNPq-LfCNZ@1W14cNPq-LfCNZ@1W14cNPq-LfCNZ@1W14cNPq-LfCNZ@ z1W14cNPq-LfCNZ@1W14cNPq-LfCNZ@1W14cNPq-LfCNZ@1W14cNPq-LfCNZ@1W14c zNPq-LfCNZ@1W14cNPq-LfCNZ@1W14cNPq-LfCNZ@1W14cNPq-LfCNZ@1W14cNPq-L zfCNZ@1W14cNPq-LfCNZ@1W14cNPq-LfCNZ@1W14cNPq-LfCNZ@1W14cNPq-LfCNZ@ z1W14cNPq-LfCNZ@1W14cNPq-LfCNZ@1W14cNPq-LfCNZ@1W14cNPq-LfCNZ@1W14c zNPq-LfCNZ@1W14cNPq-LfCNZ@1W14cNPq-LfCNZ@1W14cNPq-LfCNZ@1W14cNPq-L z;D#X(kpOIQr4}V2)u@M1)8a~09MmeM##q~nR<*=s2+z1|k|272gSx#w{pi5>#t#KUbm5$;Ki9B_S<^GF`36rfqzC7jcxE6O`vm1}Q#{D|WeX-$Ma$hY^ z`8%$~-Pi0o=Kj(1)EAzudZqP^za)PC*WaKVc8SJACdDulLUQiLs%S^EQ8+Ix|< zP$fppY#6sJnwn$ZPyO1ha^zzO%A!_^V->^w=TI7 zRUiQgNI(J-kbndvAOQ(TKmrnwz>ETGhx*s-DD33l_~mW7&;3@+e+rxkfmL0DXUfr^ z{oUGmJ!dMxHjY;V)mw#DurJLOX}G%%;^ zm&^NaUV9|*_px`ptmmQH`=E2l33rDbA820oz@v@1@a^=G`lB3)MYZH`h=(>n+m2VK zuoipJhXO`<{tWkEFfM#Go5DDTF~q_V7Noo;>|od^cHthZ;A;duywb;*ZXPe^=K!zl zMv-Sl^fPif&x^di0()6j;OA|)m9N`*bSv)Sd*AuyM=m%^c%{-mm@AjJVpo7oc#JiV zMlEuJx0Fg>W4~NRKiU^!W7PT{w$;n1-7LL>dz+h#8-C!Ulbs!AA&|+y3%17dp}x+? z{TPexWKkB`WJ?kq40}9|__(`b0@ix8vTO7u-yrU0Hz#6MF<~due`vuP}j@79+CeJgX^%MLcm&&fp(HY+&(Y%v+I; zy>z$G6zY7kZ{*4M;u@R3Q^iIHBGWYt?PCWlMZJuPc%IkjqE`hpC)o5&L&m-Nz{ zE&o|d+LARBv>#xF)@AESSw4|TBW-9p-z!n8dd(-PVSkvX2Y)sSKRAbYnR2pU*ZV@^5i%Je)JnHyZ z)KEFS>#QHlCaf>%KUKzawugZue8s&85eBxjT56xZJEZWA*wz7LDiJ2V+Gsl2Vr<(t zIYrknvYQjB5cS)VRtwMfN~Ns~uvN_x*IWoAs9{b8>sqmj z+j-u|_eRd`JD8#_j%pL%ms6!kLYwWDht;g!EzpOShm5h5jj`8dUf?E11a7VFZx67U z2O|mg!x}{q)W8a@WCrUbuMWX<>_2FUPr;UCsa3nDU$tV=T83 zTI6=z^22X+jdy*2{o&*HH7A$;wq~+Id8zKX_v}2k$lGz%-GAIN^3v}X)jvPWx2M~p zn6Za>Xy386wLWFj$t~5b(bVqdbz24RXIG*Lrh--x+-@x6wOm3-ZTeT>XA-+44~U&$rgj&A4ci5a3A8M`u$&U3aj@s4=2 z?=5W-kbndvAOQ(TKmrnwfCMBU0SQPz0uqpb1SB8<2}nQ!5|DrdBp?9^NI(J-kbndv zAOQ(TKmrnwfCMBU0SQPz0uqpb1SB8<2}nQ!5|DrdBp?9^NI(J-kbndvAOQ(TKmrnw zfCMBU0SQPz0uqpb1SB8<2}nQ!5|DrdBp?9^NI(J-kbndvAOQ(TKmrnwfCMBU0SQPz z0uqpb1SB8<2}nQ!5|DrdBp?9^NI(J-kbndvAOQ(TKmrnwfCMBU0SQPz0uqpb1SB8< z2}nQ!5|DrdBp?9^NI(J-kbndvAOQ(TKmrnwfCMBU0SQPz0uqpb1SB8<2}nQ!5|Drd zBp?9^NI(J-kbndvAOQ(TKmrnwfCMBU0SQPz0uqpb1SB8<2}nQ!5|DrdBp?9^NI(J- zkbndvAOQ(TKmr#R2#{bvh&t{$)biNpk?kSU@OV^>Sy2`1cvg!ny7-yJLL_o}T@y>2Wbz?iP?8Ym>E9V*p-)}qe;-aCS|0Vp{ z=T+|tw6G_`QID#<;MY~{jbS_t6vsJ`h6cbsua8H!?Hgr+)qw)k6WD1-SrIDocl4l-w?ace)4j2Ta5S8e}X0-DKoIALxv~uvht>6CFPnVr)%C9It;w(77@j17Ax#wke zoVS)wFK6DSTBlr#Q{}Cd531|gRh+krtW#fz-G5cJJzA}=+&bl2oX*|#?Amj;c|Rw1 zAFsch?o+K(uEpuxUC*v!_y2vJdiX~*uQtB**W54vw!cs;4D`&nPTd&it^3E9GjCI^ zQ?A9S^7e8La6P+<^LF7n<=O8j_x&(8c5gUxCEO?eo^mZt=k9uT&A3OuUoZZ9|NOW3 Hj0gV)w~Z5L literal 0 HcmV?d00001 diff --git a/x-pack/winlogbeat/module/security/test/testdata/4912_WindowsSrv2016.evtx b/x-pack/winlogbeat/module/security/test/testdata/4912_WindowsSrv2016.evtx new file mode 100644 index 0000000000000000000000000000000000000000..15a93a947a21e60b5c5de31a57cd5c14625ff795 GIT binary patch literal 69632 zcmeI1X>3$g6vxk-c{99DXX((?1w{d=QnaN7i(ql7v{jVCXe(kYN~JB7PG@QtC^j0R z7!$YP8WQ|KOpL)T8e<^DsF9fP!Qd7l7-M2$;zCRmF&H%&|L4B zIrrXkf9KqDZ>P=ao|fKpw-l#y(-QrS$4&P{#-f># z16IPaBx?Pz?6MF29-4ow;fmYtt4lhcM_#LX9V=0(#-!{(Ru`ygPc$UWvO&5fBf}^^ ziYL6@YkV&el2PfGG#ZD{5VGoJ9mIxZK(3ZK_zcM!)O16p6Zsmvdr>neS(LKU1IZec zv#6gV8_|}*d#=>tb0u=MvH;)R$EP1ECmv*6-cjQ~Mol&XtzEn#7egZK$LgM?VYwaa)tS9DN2NSy$CEPM zmdOx>Tbc)6jKj=bp(7RINK(oqfmX*njzo+cx|r00lD1>na#e7;*45XRyKU1pKYHZg zKWW6wg;QI)uNx5=GVcRc6z2XuDiZtNi>|HEyD*qlgN+8UF06YaRIi?}#%lP-2-}^6<~CyAB`uC55e{ zQm|kXvU=ufYI;cB%Maa6#??DfuTilXZ#{$6%O1hYnp^8EvD z|9M{jQ)s;u{nz5jz=>4rpc|m-yq=fjXO6*VJK=0=vEGTRwcXXKrb=#VzF!0z#f@k> z&!7nuI#bBi@q{zEWOZ-o)++25cKe-zYjHpSSPH}to0MyVr)70s%gN(BF9kjI1X=@K z{b-=89)i{mX14`*2pk;cG6h=%HFzpaIf^_EMYDZ0k5fTYr~+Tl?s|K)WB%BVxxv~e zj$)5Ag0~*{89aI@51Q2~AwNPq(27WdbgEG*;gSn*DYy!;Me}ts51%@eZ+>Qf^v&Kw z$@jlZrP@=qwXWoqQV(e)y$8v>LqmN#XMEUEHFw4Cna_^?{RirFuYl1{$fjV)0!D@B zlYdmYmj*uo>jqM1-;U1b;||ID~Z+g|H56`vDlzb=2h; z*S*md8dRm)aBa8;?@=5Kdc*63Lk*&)$(Vn@9Fd!#MI{*JZ)qx-1&2!MD5#$YBdUHQ zs9k0x+zXTI`tFfkgBkSr6q$y&EZ5_KcB>J*%sm+ItEXw5$V0DAuQ)d09(^kQI2pWla~`>H;NL(zMEEf5tmL`s?jq_RLuF%HhN(ZeM2QTZ(DWO*WdiL_1v=?ZH~DG zstMKfE^s}`qt@!wgS-0UMr+ahU6*WIxoGRrcRru-$`_xa+S^}yk=6ZG5S#Pb4`bXx zjGRBB{`d|^F(rxY@6#)cO zTmM^bcFru=RxSR2?ix(ZL;@s00wh2JBtQZrKmsH{0wh2JBtQZrKmsH{0wh2JBtQZr zKmsH{0wh2JBtQZrKmsH{0wh2JBtQZrKmsH{0wh2JBtQZrKmsH{0wh2JBtQZrKmsH{ z0wh2JBtQZrKmsH{0wh2JBtQZrKmsH{0wh2JBtQZrKmsH{0wh2JBtQZrKmsH{0wh2J zBtQZrKmsH{0wh2JBtQZrKmsH{0wh2JBtQZrKmsH{0wh2JBtQZrKmsH{0wh2JBtQZr zKmsH{0wh2JBtQZrKmsH{0wh2JBtQZrKmsH{0wh2JBtQZrKmsH{0wh2JBtQZrKmsH{ z0wh2JBtQZrKmsH{0wh2JBtQZrKmsH{0wh2JBtQZrKmsH{0wh2JBtQZrKmsH{0wh2J zBtQZrKmsH{0wh2JBtQZrKmsH{0wh2JBtQZrKmsH{0wh2JBtQZrKmsH{0wh2JBtQZr uKmsH{0wh2Jrzg-WS;q^BKV2OF literal 0 HcmV?d00001 From 4b6813efc78c30ab43fc04219a7bd0e49da77687 Mon Sep 17 00:00:00 2001 From: Anabella Cristaldi Date: Wed, 19 Aug 2020 12:37:01 +0200 Subject: [PATCH 2/5] Audit and Authentication Policy Change Events - CHANGELOG --- CHANGELOG.next.asciidoc | 1 + 1 file changed, 1 insertion(+) diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index 1d9bacfa6bb..a203f6990fc 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -973,6 +973,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d - Add additional event categorization for security and sysmon modules. {pull}22988[22988] - Add dns.question.subdomain fields for sysmon DNS events. {pull}22999[22999] - Add dns.question.top_level_domain fields for sysmon DNS events. {pull}23046[23046] +- Add Audit and Authentication Polixy Change Events and related.ip information {pull}20684[20684] *Elastic Log Driver* From 35a2effb11dbfab2cf9d8fbb7580ea4918e2e986 Mon Sep 17 00:00:00 2001 From: Anabella Cristaldi Date: Wed, 18 Nov 2020 17:25:22 +0100 Subject: [PATCH 3/5] new ECS 1.7.0 event.category configuration for audit changes --- .../module/security/config/winlogbeat-security.js | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/x-pack/winlogbeat/module/security/config/winlogbeat-security.js b/x-pack/winlogbeat/module/security/config/winlogbeat-security.js index 4895ba807e6..62ce461b1b6 100644 --- a/x-pack/winlogbeat/module/security/config/winlogbeat-security.js +++ b/x-pack/winlogbeat/module/security/config/winlogbeat-security.js @@ -2316,7 +2316,7 @@ var security = (function () { .Add(addEventFields) .Add(addTrustInformation) .Add(function(evt) { - evt.AppendTo("event.type", "change"); + evt.AppendTo("event.type", "admin"); }) .Build(); @@ -2325,7 +2325,7 @@ var security = (function () { .Add(copySubjectUserLogonId) .Add(addEventFields) .Add(function(evt) { - evt.AppendTo("event.type", "change"); + evt.AppendTo("event.type", "admin"); }) .Build(); @@ -2335,7 +2335,7 @@ var security = (function () { .Add(renameCommonAuthFields) .Add(addEventFields) .Add(function(evt) { - evt.AppendTo("event.type", "change"); + evt.AppendTo("event.type", "admin"); var oldSd = evt.Get("winlog.event_data.OldSd"); var newSd = evt.Get("winlog.event_data.NewSd"); if (oldSd) { @@ -2350,14 +2350,14 @@ var security = (function () { var genericAuditChange = new processor.Chain() .Add(addEventFields) .Add(function(evt) { - evt.AppendTo("event.type", "change"); + evt.AppendTo("event.type", "admin"); }) .Build(); var event4908 = new processor.Chain() .Add(addEventFields) .Add(function(evt) { - evt.AppendTo("event.type", "change"); + evt.AppendTo("event.type", "admin"); var sids = evt.Get("winlog.event_data.SidList"); if (!sids) { return; @@ -2381,7 +2381,7 @@ var security = (function () { .Add(renameCommonAuthFields) .Add(addEventFields) .Add(function(evt) { - evt.AppendTo("event.type", "change"); + evt.AppendTo("event.type", "admin"); }) .Build(); @@ -2524,6 +2524,7 @@ var security = (function () { // 4739 - A security-enabled global group was changed. 4739: policyChange.Run, + // 4738 - An user account was changed. 4738: userMgmtEvts.Run, From e2fbcc5361535823376146add9ec16f9530ea685 Mon Sep 17 00:00:00 2001 From: "Lee E. Hinman" Date: Wed, 20 Jan 2021 15:07:46 -0600 Subject: [PATCH 4/5] Merge fixes and updated golden files --- .../security/config/winlogbeat-security.js | 16 +--- .../4670_WindowsSrv2016.evtx.golden.json | 80 +++++++++++++++++++ .../4706_WindowsSrv2016.evtx.golden.json | 72 +++++++++++++++++ .../4707_WindowsSrv2016.evtx.golden.json | 64 +++++++++++++++ .../4713_WindowsSrv2016.evtx.golden.json | 64 +++++++++++++++ .../4716_WindowsSrv2016.evtx.golden.json | 72 +++++++++++++++++ .../4717_WindowsSrv2016.evtx.golden.json | 67 ++++++++++++++++ .../4718_WindowsSrv2016.evtx.golden.json | 67 ++++++++++++++++ .../4719_WindowsSrv2016.evtx.golden.json | 74 +++++++++++++++++ .../4739_WindowsSrv2016.evtx.golden.json | 71 ++++++++++++++++ .../4817_WindowsSrv2016.evtx.golden.json | 74 +++++++++++++++++ .../4902_WindowsSrv2016.evtx.golden.json | 51 ++++++++++++ .../4904_WindowsSrv2016.evtx.golden.json | 72 +++++++++++++++++ .../4905_WindowsSrv2016.evtx.golden.json | 72 +++++++++++++++++ .../4906_WindowsSrv2016.evtx.golden.json | 50 ++++++++++++ .../4907_WindowsSrv2016.evtx.golden.json | 75 +++++++++++++++++ .../4908_WindowsSrv2016.evtx.golden.json | 58 ++++++++++++++ .../4912_WindowsSrv2016.evtx.golden.json | 70 ++++++++++++++++ ...security-windows2012_4771.evtx.golden.json | 1 + ...security-windows2012_4778.evtx.golden.json | 1 + ...security-windows2012_4779.evtx.golden.json | 1 + 21 files changed, 1157 insertions(+), 15 deletions(-) create mode 100644 x-pack/winlogbeat/module/security/test/testdata/4670_WindowsSrv2016.evtx.golden.json create mode 100644 x-pack/winlogbeat/module/security/test/testdata/4706_WindowsSrv2016.evtx.golden.json create mode 100644 x-pack/winlogbeat/module/security/test/testdata/4707_WindowsSrv2016.evtx.golden.json create mode 100644 x-pack/winlogbeat/module/security/test/testdata/4713_WindowsSrv2016.evtx.golden.json create mode 100644 x-pack/winlogbeat/module/security/test/testdata/4716_WindowsSrv2016.evtx.golden.json create mode 100644 x-pack/winlogbeat/module/security/test/testdata/4717_WindowsSrv2016.evtx.golden.json create mode 100644 x-pack/winlogbeat/module/security/test/testdata/4718_WindowsSrv2016.evtx.golden.json create mode 100644 x-pack/winlogbeat/module/security/test/testdata/4719_WindowsSrv2016.evtx.golden.json create mode 100644 x-pack/winlogbeat/module/security/test/testdata/4739_WindowsSrv2016.evtx.golden.json create mode 100644 x-pack/winlogbeat/module/security/test/testdata/4817_WindowsSrv2016.evtx.golden.json create mode 100644 x-pack/winlogbeat/module/security/test/testdata/4902_WindowsSrv2016.evtx.golden.json create mode 100644 x-pack/winlogbeat/module/security/test/testdata/4904_WindowsSrv2016.evtx.golden.json create mode 100644 x-pack/winlogbeat/module/security/test/testdata/4905_WindowsSrv2016.evtx.golden.json create mode 100644 x-pack/winlogbeat/module/security/test/testdata/4906_WindowsSrv2016.evtx.golden.json create mode 100644 x-pack/winlogbeat/module/security/test/testdata/4907_WindowsSrv2016.evtx.golden.json create mode 100644 x-pack/winlogbeat/module/security/test/testdata/4908_WindowsSrv2016.evtx.golden.json create mode 100644 x-pack/winlogbeat/module/security/test/testdata/4912_WindowsSrv2016.evtx.golden.json diff --git a/x-pack/winlogbeat/module/security/config/winlogbeat-security.js b/x-pack/winlogbeat/module/security/config/winlogbeat-security.js index 62ce461b1b6..bee92e1e975 100644 --- a/x-pack/winlogbeat/module/security/config/winlogbeat-security.js +++ b/x-pack/winlogbeat/module/security/config/winlogbeat-security.js @@ -1209,7 +1209,7 @@ var security = (function () { "8448": "Success removed", "8449": "Success Added", "8450": "Failure removed", - "8451": "Failure added", + "8451": "Failure Added", "8452": "Success include removed", "8453": "Success include added", "8454": "Success exclude removed", @@ -2315,18 +2315,12 @@ var security = (function () { .Add(copySubjectUserLogonId) .Add(addEventFields) .Add(addTrustInformation) - .Add(function(evt) { - evt.AppendTo("event.type", "admin"); - }) .Build(); var policyChange = new processor.Chain() .Add(copySubjectUser) .Add(copySubjectUserLogonId) .Add(addEventFields) - .Add(function(evt) { - evt.AppendTo("event.type", "admin"); - }) .Build(); var objectPolicyChange = new processor.Chain() @@ -2335,7 +2329,6 @@ var security = (function () { .Add(renameCommonAuthFields) .Add(addEventFields) .Add(function(evt) { - evt.AppendTo("event.type", "admin"); var oldSd = evt.Get("winlog.event_data.OldSd"); var newSd = evt.Get("winlog.event_data.NewSd"); if (oldSd) { @@ -2349,15 +2342,11 @@ var security = (function () { var genericAuditChange = new processor.Chain() .Add(addEventFields) - .Add(function(evt) { - evt.AppendTo("event.type", "admin"); - }) .Build(); var event4908 = new processor.Chain() .Add(addEventFields) .Add(function(evt) { - evt.AppendTo("event.type", "admin"); var sids = evt.Get("winlog.event_data.SidList"); if (!sids) { return; @@ -2380,9 +2369,6 @@ var security = (function () { .Add(copySubjectUserLogonId) .Add(renameCommonAuthFields) .Add(addEventFields) - .Add(function(evt) { - evt.AppendTo("event.type", "admin"); - }) .Build(); return { diff --git a/x-pack/winlogbeat/module/security/test/testdata/4670_WindowsSrv2016.evtx.golden.json b/x-pack/winlogbeat/module/security/test/testdata/4670_WindowsSrv2016.evtx.golden.json new file mode 100644 index 00000000000..0666a8b5ac8 --- /dev/null +++ b/x-pack/winlogbeat/module/security/test/testdata/4670_WindowsSrv2016.evtx.golden.json @@ -0,0 +1,80 @@ +[ + { + "@timestamp": "2020-07-28T13:22:18.7993488Z", + "event": { + "action": "permissions-changed", + "category": [ + "iam", + "configuration" + ], + "code": 4670, + "kind": "event", + "module": "security", + "outcome": "success", + "provider": "Microsoft-Windows-Security-Auditing", + "type": [ + "admin", + "change" + ] + }, + "host": { + "name": "WIN-BVM4LI1L1Q6.TEST.local" + }, + "log": { + "level": "information" + }, + "process": { + "executable": "C:\\Windows\\System32\\services.exe", + "name": "services.exe", + "pid": 764 + }, + "related": { + "user": "WIN-BVM4LI1L1Q6$" + }, + "user": { + "domain": "TEST", + "id": "S-1-5-18", + "name": "WIN-BVM4LI1L1Q6$" + }, + "winlog": { + "api": "wineventlog", + "channel": "Security", + "computer_name": "WIN-BVM4LI1L1Q6.TEST.local", + "event_data": { + "HandleId": "0x56c", + "NewSd": "D:(A;;GA;;;SY)(A;;RC;;;OW)(A;;GA;;;S-1-5-80-123231216-2592883651-3715271367-3753151631-4175906628)", + "NewSdDacl0": "Local system :Access Allowed (Generic All)", + "NewSdDacl1": "OW :Access Allowed (Read Permissions)", + "NewSdDacl2": "S-1-5-80-123231216-2592883651-3715271367-3753151631-4175906628 :Access Allowed (Generic All)", + "ObjectName": "-", + "ObjectServer": "Security", + "ObjectType": "Token", + "OldSd": "D:(A;;GA;;;SY)(A;;GA;;;NS)", + "OldSdDacl0": "Local system :Access Allowed (Generic All)", + "OldSdDacl1": "Network service account :Access Allowed (Generic All)", + "SubjectDomainName": "TEST", + "SubjectLogonId": "0x3e7", + "SubjectUserName": "WIN-BVM4LI1L1Q6$", + "SubjectUserSid": "S-1-5-18" + }, + "event_id": 4670, + "keywords": [ + "Audit Success" + ], + "logon": { + "id": "0x3e7" + }, + "opcode": "Info", + "process": { + "pid": 4, + "thread": { + "id": 4604 + } + }, + "provider_guid": "{54849625-5478-4994-a5ba-3e3b0328c30d}", + "provider_name": "Microsoft-Windows-Security-Auditing", + "record_id": 31932, + "task": "Authorization Policy Change" + } + } +] \ No newline at end of file diff --git a/x-pack/winlogbeat/module/security/test/testdata/4706_WindowsSrv2016.evtx.golden.json b/x-pack/winlogbeat/module/security/test/testdata/4706_WindowsSrv2016.evtx.golden.json new file mode 100644 index 00000000000..7cdf639ce48 --- /dev/null +++ b/x-pack/winlogbeat/module/security/test/testdata/4706_WindowsSrv2016.evtx.golden.json @@ -0,0 +1,72 @@ +[ + { + "@timestamp": "2020-07-27T09:42:48.3690009Z", + "event": { + "action": "domain-trust-added", + "category": [ + "configuration" + ], + "code": 4706, + "kind": "event", + "module": "security", + "outcome": "success", + "provider": "Microsoft-Windows-Security-Auditing", + "type": [ + "creation" + ] + }, + "host": { + "name": "WIN-BVM4LI1L1Q6.TEST.local" + }, + "log": { + "level": "information" + }, + "related": { + "user": "Administrator" + }, + "user": { + "domain": "TEST", + "id": "S-1-5-21-2024912787-2692429404-2351956786-500", + "name": "Administrator" + }, + "winlog": { + "activity_id": "{be129571-63f8-0000-a795-12bef863d601}", + "api": "wineventlog", + "channel": "Security", + "computer_name": "WIN-BVM4LI1L1Q6.TEST.local", + "event_data": { + "DomainName": "192.168.230.153", + "DomainSid": "S-1-0-0", + "SidFilteringEnabled": "%%1796", + "SubjectDomainName": "TEST", + "SubjectLogonId": "0x6a868", + "SubjectUserName": "Administrator", + "SubjectUserSid": "S-1-5-21-2024912787-2692429404-2351956786-500", + "TdoAttributes": "1", + "TdoDirection": "3", + "TdoType": "3" + }, + "event_id": 4706, + "keywords": [ + "Audit Success" + ], + "logon": { + "id": "0x6a868" + }, + "opcode": "Info", + "process": { + "pid": 776, + "thread": { + "id": 3056 + } + }, + "provider_guid": "{54849625-5478-4994-a5ba-3e3b0328c30d}", + "provider_name": "Microsoft-Windows-Security-Auditing", + "record_id": 6017, + "task": "Authentication Policy Change", + "trustAttribute": "TRUST_ATTRIBUTE_NON_TRANSITIVE", + "trustDirection": "TRUST_DIRECTION_BIDIRECTIONAL", + "trustType": "TRUST_TYPE_MIT" + } + } +] \ No newline at end of file diff --git a/x-pack/winlogbeat/module/security/test/testdata/4707_WindowsSrv2016.evtx.golden.json b/x-pack/winlogbeat/module/security/test/testdata/4707_WindowsSrv2016.evtx.golden.json new file mode 100644 index 00000000000..d16ff334435 --- /dev/null +++ b/x-pack/winlogbeat/module/security/test/testdata/4707_WindowsSrv2016.evtx.golden.json @@ -0,0 +1,64 @@ +[ + { + "@timestamp": "2020-07-28T06:18:04.600444Z", + "event": { + "action": "domain-trust-removed", + "category": [ + "configuration" + ], + "code": 4707, + "kind": "event", + "module": "security", + "outcome": "success", + "provider": "Microsoft-Windows-Security-Auditing", + "type": [ + "deletion" + ] + }, + "host": { + "name": "WIN-BVM4LI1L1Q6.TEST.local" + }, + "log": { + "level": "information" + }, + "related": { + "user": "Administrator" + }, + "user": { + "domain": "TEST", + "id": "S-1-5-21-2024912787-2692429404-2351956786-500", + "name": "Administrator" + }, + "winlog": { + "api": "wineventlog", + "channel": "Security", + "computer_name": "WIN-BVM4LI1L1Q6.TEST.local", + "event_data": { + "DomainName": "192.168.230.153", + "DomainSid": "S-1-0-0", + "SubjectDomainName": "TEST", + "SubjectLogonId": "0x6a868", + "SubjectUserName": "Administrator", + "SubjectUserSid": "S-1-5-21-2024912787-2692429404-2351956786-500" + }, + "event_id": 4707, + "keywords": [ + "Audit Success" + ], + "logon": { + "id": "0x6a868" + }, + "opcode": "Info", + "process": { + "pid": 776, + "thread": { + "id": 2012 + } + }, + "provider_guid": "{54849625-5478-4994-a5ba-3e3b0328c30d}", + "provider_name": "Microsoft-Windows-Security-Auditing", + "record_id": 13679, + "task": "Authentication Policy Change" + } + } +] \ No newline at end of file diff --git a/x-pack/winlogbeat/module/security/test/testdata/4713_WindowsSrv2016.evtx.golden.json b/x-pack/winlogbeat/module/security/test/testdata/4713_WindowsSrv2016.evtx.golden.json new file mode 100644 index 00000000000..9dcfe4ddb59 --- /dev/null +++ b/x-pack/winlogbeat/module/security/test/testdata/4713_WindowsSrv2016.evtx.golden.json @@ -0,0 +1,64 @@ +[ + { + "@timestamp": "2020-07-28T10:15:43.4951882Z", + "event": { + "action": "kerberos-policy-changed", + "category": [ + "configuration" + ], + "code": 4713, + "kind": "event", + "module": "security", + "outcome": "success", + "provider": "Microsoft-Windows-Security-Auditing", + "type": [ + "change" + ] + }, + "host": { + "name": "WIN-BVM4LI1L1Q6.TEST.local" + }, + "log": { + "level": "information" + }, + "related": { + "user": "WIN-BVM4LI1L1Q6$" + }, + "user": { + "domain": "TEST", + "id": "S-1-5-18", + "name": "WIN-BVM4LI1L1Q6$" + }, + "winlog": { + "activity_id": "{be129571-63f8-0000-a795-12bef863d601}", + "api": "wineventlog", + "channel": "Security", + "computer_name": "WIN-BVM4LI1L1Q6.TEST.local", + "event_data": { + "KerberosPolicyChange": "KerMinT: 0x53d1ac1000 (0x53ade8ca00); KerMaxR: 0x649534e0000 (0x58028e44000); KerProxy: 0xd693a400 (0xb2d05e00); ", + "SubjectDomainName": "TEST", + "SubjectLogonId": "0x3e7", + "SubjectUserName": "WIN-BVM4LI1L1Q6$", + "SubjectUserSid": "S-1-5-18" + }, + "event_id": 4713, + "keywords": [ + "Audit Success" + ], + "logon": { + "id": "0x3e7" + }, + "opcode": "Info", + "process": { + "pid": 776, + "thread": { + "id": 2012 + } + }, + "provider_guid": "{54849625-5478-4994-a5ba-3e3b0328c30d}", + "provider_name": "Microsoft-Windows-Security-Auditing", + "record_id": 21265, + "task": "Authentication Policy Change" + } + } +] \ No newline at end of file diff --git a/x-pack/winlogbeat/module/security/test/testdata/4716_WindowsSrv2016.evtx.golden.json b/x-pack/winlogbeat/module/security/test/testdata/4716_WindowsSrv2016.evtx.golden.json new file mode 100644 index 00000000000..6e43b04c6f3 --- /dev/null +++ b/x-pack/winlogbeat/module/security/test/testdata/4716_WindowsSrv2016.evtx.golden.json @@ -0,0 +1,72 @@ +[ + { + "@timestamp": "2020-07-28T08:17:00.4706442Z", + "event": { + "action": "trusted-domain-information-changed", + "category": [ + "configuration" + ], + "code": 4716, + "kind": "event", + "module": "security", + "outcome": "success", + "provider": "Microsoft-Windows-Security-Auditing", + "type": [ + "change" + ] + }, + "host": { + "name": "WIN-BVM4LI1L1Q6.TEST.local" + }, + "log": { + "level": "information" + }, + "related": { + "user": "Administrator" + }, + "user": { + "domain": "TEST", + "id": "S-1-5-21-2024912787-2692429404-2351956786-500", + "name": "Administrator" + }, + "winlog": { + "activity_id": "{be129571-63f8-0000-a795-12bef863d601}", + "api": "wineventlog", + "channel": "Security", + "computer_name": "WIN-BVM4LI1L1Q6.TEST.local", + "event_data": { + "DomainName": "-", + "DomainSid": "S-1-0-0", + "SidFilteringEnabled": "-", + "SubjectDomainName": "TEST", + "SubjectLogonId": "0x6a868", + "SubjectUserName": "Administrator", + "SubjectUserSid": "S-1-5-21-2024912787-2692429404-2351956786-500", + "TdoAttributes": "1", + "TdoDirection": "3", + "TdoType": "3" + }, + "event_id": 4716, + "keywords": [ + "Audit Success" + ], + "logon": { + "id": "0x6a868" + }, + "opcode": "Info", + "process": { + "pid": 776, + "thread": { + "id": 3776 + } + }, + "provider_guid": "{54849625-5478-4994-a5ba-3e3b0328c30d}", + "provider_name": "Microsoft-Windows-Security-Auditing", + "record_id": 14929, + "task": "Authentication Policy Change", + "trustAttribute": "TRUST_ATTRIBUTE_NON_TRANSITIVE", + "trustDirection": "TRUST_DIRECTION_BIDIRECTIONAL", + "trustType": "TRUST_TYPE_MIT" + } + } +] \ No newline at end of file diff --git a/x-pack/winlogbeat/module/security/test/testdata/4717_WindowsSrv2016.evtx.golden.json b/x-pack/winlogbeat/module/security/test/testdata/4717_WindowsSrv2016.evtx.golden.json new file mode 100644 index 00000000000..fe3d49133e0 --- /dev/null +++ b/x-pack/winlogbeat/module/security/test/testdata/4717_WindowsSrv2016.evtx.golden.json @@ -0,0 +1,67 @@ +[ + { + "@timestamp": "2020-07-27T09:30:41.9034803Z", + "event": { + "action": "system-security-access-granted", + "category": [ + "iam", + "configuration" + ], + "code": 4717, + "kind": "event", + "module": "security", + "outcome": "success", + "provider": "Microsoft-Windows-Security-Auditing", + "type": [ + "admin", + "change" + ] + }, + "host": { + "name": "WIN-BVM4LI1L1Q6" + }, + "log": { + "level": "information" + }, + "related": { + "user": "WIN-BVM4LI1L1Q6$" + }, + "user": { + "domain": "WORKGROUP", + "id": "S-1-5-18", + "name": "WIN-BVM4LI1L1Q6$" + }, + "winlog": { + "activity_id": "{b69bb9ff-63f5-0000-35ba-9bb6f563d601}", + "api": "wineventlog", + "channel": "Security", + "computer_name": "WIN-BVM4LI1L1Q6", + "event_data": { + "AccessGranted": "SeNetworkLogonRight", + "SubjectDomainName": "WORKGROUP", + "SubjectLogonId": "0x3e7", + "SubjectUserName": "WIN-BVM4LI1L1Q6$", + "SubjectUserSid": "S-1-5-18", + "TargetSid": "S-1-5-9" + }, + "event_id": 4717, + "keywords": [ + "Audit Success" + ], + "logon": { + "id": "0x3e7" + }, + "opcode": "Info", + "process": { + "pid": 776, + "thread": { + "id": 820 + } + }, + "provider_guid": "{54849625-5478-4994-a5ba-3e3b0328c30d}", + "provider_name": "Microsoft-Windows-Security-Auditing", + "record_id": 1571, + "task": "Authentication Policy Change" + } + } +] \ No newline at end of file diff --git a/x-pack/winlogbeat/module/security/test/testdata/4718_WindowsSrv2016.evtx.golden.json b/x-pack/winlogbeat/module/security/test/testdata/4718_WindowsSrv2016.evtx.golden.json new file mode 100644 index 00000000000..6e5fc0f6d54 --- /dev/null +++ b/x-pack/winlogbeat/module/security/test/testdata/4718_WindowsSrv2016.evtx.golden.json @@ -0,0 +1,67 @@ +[ + { + "@timestamp": "2020-07-27T09:30:41.8778082Z", + "event": { + "action": "system-security-access-removed", + "category": [ + "iam", + "configuration" + ], + "code": 4718, + "kind": "event", + "module": "security", + "outcome": "success", + "provider": "Microsoft-Windows-Security-Auditing", + "type": [ + "admin", + "deletion" + ] + }, + "host": { + "name": "WIN-BVM4LI1L1Q6" + }, + "log": { + "level": "information" + }, + "related": { + "user": "WIN-BVM4LI1L1Q6$" + }, + "user": { + "domain": "WORKGROUP", + "id": "S-1-5-18", + "name": "WIN-BVM4LI1L1Q6$" + }, + "winlog": { + "activity_id": "{b69bb9ff-63f5-0000-35ba-9bb6f563d601}", + "api": "wineventlog", + "channel": "Security", + "computer_name": "WIN-BVM4LI1L1Q6", + "event_data": { + "AccessRemoved": "SeNetworkLogonRight", + "SubjectDomainName": "WORKGROUP", + "SubjectLogonId": "0x3e7", + "SubjectUserName": "WIN-BVM4LI1L1Q6$", + "SubjectUserSid": "S-1-5-18", + "TargetSid": "S-1-5-32-545" + }, + "event_id": 4718, + "keywords": [ + "Audit Success" + ], + "logon": { + "id": "0x3e7" + }, + "opcode": "Info", + "process": { + "pid": 776, + "thread": { + "id": 820 + } + }, + "provider_guid": "{54849625-5478-4994-a5ba-3e3b0328c30d}", + "provider_name": "Microsoft-Windows-Security-Auditing", + "record_id": 1565, + "task": "Authentication Policy Change" + } + } +] \ No newline at end of file diff --git a/x-pack/winlogbeat/module/security/test/testdata/4719_WindowsSrv2016.evtx.golden.json b/x-pack/winlogbeat/module/security/test/testdata/4719_WindowsSrv2016.evtx.golden.json new file mode 100644 index 00000000000..4bc9323ce3f --- /dev/null +++ b/x-pack/winlogbeat/module/security/test/testdata/4719_WindowsSrv2016.evtx.golden.json @@ -0,0 +1,74 @@ +[ + { + "@timestamp": "2020-08-18T13:45:57.4803543Z", + "event": { + "action": "changed-audit-config", + "category": [ + "iam", + "configuration" + ], + "code": 4719, + "kind": "event", + "module": "security", + "outcome": "success", + "provider": "Microsoft-Windows-Security-Auditing", + "type": [ + "admin", + "change" + ] + }, + "host": { + "name": "WIN-BVM4LI1L1Q6.TEST.local" + }, + "log": { + "level": "information" + }, + "related": { + "user": "Administrator" + }, + "user": { + "domain": "TEST", + "id": "S-1-5-21-2024912787-2692429404-2351956786-500", + "name": "Administrator" + }, + "winlog": { + "activity_id": "{65461d39-753f-0000-731d-46653f75d601}", + "api": "wineventlog", + "channel": "Security", + "computer_name": "WIN-BVM4LI1L1Q6.TEST.local", + "event_data": { + "AuditPolicyChanges": "%%8448", + "AuditPolicyChangesDescription": [ + "Success removed" + ], + "Category": "Object Access", + "CategoryId": "%%8274", + "SubCategory": "Other Object Access Events", + "SubcategoryGuid": "{0cce9227-69ae-11d9-bed3-505054503030}", + "SubcategoryId": "%%12804", + "SubjectDomainName": "TEST", + "SubjectLogonId": "0x44d7d", + "SubjectUserName": "Administrator", + "SubjectUserSid": "S-1-5-21-2024912787-2692429404-2351956786-500" + }, + "event_id": 4719, + "keywords": [ + "Audit Success" + ], + "logon": { + "id": "0x44d7d" + }, + "opcode": "Info", + "process": { + "pid": 780, + "thread": { + "id": 2764 + } + }, + "provider_guid": "{54849625-5478-4994-a5ba-3e3b0328c30d}", + "provider_name": "Microsoft-Windows-Security-Auditing", + "record_id": 123879, + "task": "Audit Policy Change" + } + } +] \ No newline at end of file diff --git a/x-pack/winlogbeat/module/security/test/testdata/4739_WindowsSrv2016.evtx.golden.json b/x-pack/winlogbeat/module/security/test/testdata/4739_WindowsSrv2016.evtx.golden.json new file mode 100644 index 00000000000..4035618ea1d --- /dev/null +++ b/x-pack/winlogbeat/module/security/test/testdata/4739_WindowsSrv2016.evtx.golden.json @@ -0,0 +1,71 @@ +[ + { + "@timestamp": "2020-07-27T09:34:50.1578005Z", + "event": { + "action": "domain-policy-changed", + "category": [ + "configuration" + ], + "code": 4739, + "kind": "event", + "module": "security", + "outcome": "success", + "provider": "Microsoft-Windows-Security-Auditing", + "type": [ + "change" + ] + }, + "host": { + "name": "WIN-BVM4LI1L1Q6.TEST.local" + }, + "log": { + "level": "information" + }, + "related": { + "user": "WIN-BVM4LI1L1Q6$" + }, + "user": { + "domain": "TEST", + "id": "S-1-5-18", + "name": "WIN-BVM4LI1L1Q6$" + }, + "winlog": { + "api": "wineventlog", + "channel": "Security", + "computer_name": "WIN-BVM4LI1L1Q6.TEST.local", + "event_data": { + "DomainBehaviorVersion": "-", + "DomainName": "TEST", + "DomainPolicyChanged": "Password Policy", + "DomainSid": "S-1-5-21-2024912787-2692429404-2351956786", + "MachineAccountQuota": "-", + "MixedDomainMode": "-", + "OemInformation": "-", + "PasswordHistoryLength": "-", + "PrivilegeList": "-", + "SubjectDomainName": "TEST", + "SubjectLogonId": "0x3e7", + "SubjectUserName": "WIN-BVM4LI1L1Q6$", + "SubjectUserSid": "S-1-5-18" + }, + "event_id": 4739, + "keywords": [ + "Audit Success" + ], + "logon": { + "id": "0x3e7" + }, + "opcode": "Info", + "process": { + "pid": 776, + "thread": { + "id": 812 + } + }, + "provider_guid": "{54849625-5478-4994-a5ba-3e3b0328c30d}", + "provider_name": "Microsoft-Windows-Security-Auditing", + "record_id": 3532, + "task": "Authentication Policy Change" + } + } +] \ No newline at end of file diff --git a/x-pack/winlogbeat/module/security/test/testdata/4817_WindowsSrv2016.evtx.golden.json b/x-pack/winlogbeat/module/security/test/testdata/4817_WindowsSrv2016.evtx.golden.json new file mode 100644 index 00000000000..71607b7242c --- /dev/null +++ b/x-pack/winlogbeat/module/security/test/testdata/4817_WindowsSrv2016.evtx.golden.json @@ -0,0 +1,74 @@ +[ + { + "@timestamp": "2020-08-17T12:49:09.4942066Z", + "event": { + "action": "object-audit-changed", + "category": [ + "iam", + "configuration" + ], + "code": 4817, + "kind": "event", + "module": "security", + "outcome": "success", + "provider": "Microsoft-Windows-Security-Auditing", + "type": [ + "admin", + "change" + ] + }, + "host": { + "name": "WIN-BVM4LI1L1Q6.TEST.local" + }, + "log": { + "level": "information" + }, + "related": { + "user": [ + "WIN-BVM4LI1L1Q6$", + "Administrator" + ] + }, + "user": { + "domain": "TEST", + "id": "S-1-5-18", + "name": "WIN-BVM4LI1L1Q6$" + }, + "winlog": { + "activity_id": "{dfcd2c2a-7481-0000-682c-cddf8174d601}", + "api": "wineventlog", + "channel": "Security", + "computer_name": "WIN-BVM4LI1L1Q6.TEST.local", + "event_data": { + "NewSd": "S:(AU;SA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;S-1-5-21-2024912787-2692429404-2351956786-500)(AU;SA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;S-1-5-21-2024912787-2692429404-2351956786-1000)", + "NewSdSacl0": "Administrator :System Audit (Create All Child Objects,Delete All Child Objects,List Contents,All Validated,Read All Properties,Write All Properties,Delete Subtree,List Object,All Extended Rights,Delete,Read Permissions,Modify Permissions,Modify Owner)", + "NewSdSacl1": "S-1-5-21-2024912787-2692429404-2351956786-1000 :System Audit (Create All Child Objects,Delete All Child Objects,List Contents,All Validated,Read All Properties,Write All Properties,Delete Subtree,List Object,All Extended Rights,Delete,Read Permissions,Modify Permissions,Modify Owner)", + "ObjectName": "File", + "ObjectServer": "LSA", + "ObjectType": "Global SACL", + "SubjectDomainName": "TEST", + "SubjectLogonId": "0x3e7", + "SubjectUserName": "WIN-BVM4LI1L1Q6$", + "SubjectUserSid": "S-1-5-18" + }, + "event_id": 4817, + "keywords": [ + "Audit Success" + ], + "logon": { + "id": "0x3e7" + }, + "opcode": "Info", + "process": { + "pid": 776, + "thread": { + "id": 3052 + } + }, + "provider_guid": "{54849625-5478-4994-a5ba-3e3b0328c30d}", + "provider_name": "Microsoft-Windows-Security-Auditing", + "record_id": 114278, + "task": "Audit Policy Change" + } + } +] \ No newline at end of file diff --git a/x-pack/winlogbeat/module/security/test/testdata/4902_WindowsSrv2016.evtx.golden.json b/x-pack/winlogbeat/module/security/test/testdata/4902_WindowsSrv2016.evtx.golden.json new file mode 100644 index 00000000000..0c21de310ab --- /dev/null +++ b/x-pack/winlogbeat/module/security/test/testdata/4902_WindowsSrv2016.evtx.golden.json @@ -0,0 +1,51 @@ +[ + { + "@timestamp": "2020-08-19T06:07:08.801981Z", + "event": { + "action": "user-audit-policy-created", + "category": [ + "iam", + "configuration" + ], + "code": 4902, + "kind": "event", + "module": "security", + "outcome": "success", + "provider": "Microsoft-Windows-Security-Auditing", + "type": [ + "admin", + "creation" + ] + }, + "host": { + "name": "WIN-BVM4LI1L1Q6.TEST.local" + }, + "log": { + "level": "information" + }, + "winlog": { + "api": "wineventlog", + "channel": "Security", + "computer_name": "WIN-BVM4LI1L1Q6.TEST.local", + "event_data": { + "PuaCount": "0", + "PuaPolicyId": "0x9fd2" + }, + "event_id": 4902, + "keywords": [ + "Audit Success" + ], + "opcode": "Info", + "process": { + "pid": 784, + "thread": { + "id": 832 + } + }, + "provider_guid": "{54849625-5478-4994-a5ba-3e3b0328c30d}", + "provider_name": "Microsoft-Windows-Security-Auditing", + "record_id": 140273, + "task": "Audit Policy Change" + } + } +] \ No newline at end of file diff --git a/x-pack/winlogbeat/module/security/test/testdata/4904_WindowsSrv2016.evtx.golden.json b/x-pack/winlogbeat/module/security/test/testdata/4904_WindowsSrv2016.evtx.golden.json new file mode 100644 index 00000000000..cb92cffa1b2 --- /dev/null +++ b/x-pack/winlogbeat/module/security/test/testdata/4904_WindowsSrv2016.evtx.golden.json @@ -0,0 +1,72 @@ +[ + { + "@timestamp": "2020-08-19T07:56:52.019802Z", + "event": { + "action": "security-event-source-added", + "category": [ + "iam", + "configuration" + ], + "code": 4904, + "kind": "event", + "module": "security", + "outcome": "success", + "provider": "Microsoft-Windows-Security-Auditing", + "type": [ + "admin", + "change" + ] + }, + "host": { + "name": "WIN-BVM4LI1L1Q6.TEST.local" + }, + "log": { + "level": "information" + }, + "process": { + "executable": "C:\\Windows\\System32\\inetsrv\\inetinfo.exe", + "name": "inetinfo.exe", + "pid": 3608 + }, + "related": { + "user": "WIN-BVM4LI1L1Q6$" + }, + "user": { + "domain": "TEST", + "id": "S-1-5-18", + "name": "WIN-BVM4LI1L1Q6$" + }, + "winlog": { + "activity_id": "{dab46f85-75ee-0000-c36f-b4daee75d601}", + "api": "wineventlog", + "channel": "Security", + "computer_name": "WIN-BVM4LI1L1Q6.TEST.local", + "event_data": { + "AuditSourceName": "IIS-METABASE", + "EventSourceId": "0x460422", + "SubjectDomainName": "TEST", + "SubjectLogonId": "0x3e7", + "SubjectUserName": "WIN-BVM4LI1L1Q6$", + "SubjectUserSid": "S-1-5-18" + }, + "event_id": 4904, + "keywords": [ + "Audit Success" + ], + "logon": { + "id": "0x3e7" + }, + "opcode": "Info", + "process": { + "pid": 784, + "thread": { + "id": 824 + } + }, + "provider_guid": "{54849625-5478-4994-a5ba-3e3b0328c30d}", + "provider_name": "Microsoft-Windows-Security-Auditing", + "record_id": 146939, + "task": "Audit Policy Change" + } + } +] \ No newline at end of file diff --git a/x-pack/winlogbeat/module/security/test/testdata/4905_WindowsSrv2016.evtx.golden.json b/x-pack/winlogbeat/module/security/test/testdata/4905_WindowsSrv2016.evtx.golden.json new file mode 100644 index 00000000000..7b5c2e7c0c7 --- /dev/null +++ b/x-pack/winlogbeat/module/security/test/testdata/4905_WindowsSrv2016.evtx.golden.json @@ -0,0 +1,72 @@ +[ + { + "@timestamp": "2020-08-19T07:56:51.5792901Z", + "event": { + "action": "security-event-source-removed", + "category": [ + "iam", + "configuration" + ], + "code": 4905, + "kind": "event", + "module": "security", + "outcome": "success", + "provider": "Microsoft-Windows-Security-Auditing", + "type": [ + "admin", + "deletion" + ] + }, + "host": { + "name": "WIN-BVM4LI1L1Q6.TEST.local" + }, + "log": { + "level": "information" + }, + "process": { + "executable": "-", + "name": "-", + "pid": 4964 + }, + "related": { + "user": "WIN-BVM4LI1L1Q6$" + }, + "user": { + "domain": "TEST", + "id": "S-1-5-18", + "name": "WIN-BVM4LI1L1Q6$" + }, + "winlog": { + "activity_id": "{dab46f85-75ee-0000-c36f-b4daee75d601}", + "api": "wineventlog", + "channel": "Security", + "computer_name": "WIN-BVM4LI1L1Q6.TEST.local", + "event_data": { + "AuditSourceName": "IIS-METABASE", + "EventSourceId": "0x457b22", + "SubjectDomainName": "TEST", + "SubjectLogonId": "0x3e7", + "SubjectUserName": "WIN-BVM4LI1L1Q6$", + "SubjectUserSid": "S-1-5-18" + }, + "event_id": 4905, + "keywords": [ + "Audit Success" + ], + "logon": { + "id": "0x3e7" + }, + "opcode": "Info", + "process": { + "pid": 784, + "thread": { + "id": 824 + } + }, + "provider_guid": "{54849625-5478-4994-a5ba-3e3b0328c30d}", + "provider_name": "Microsoft-Windows-Security-Auditing", + "record_id": 146938, + "task": "Audit Policy Change" + } + } +] \ No newline at end of file diff --git a/x-pack/winlogbeat/module/security/test/testdata/4906_WindowsSrv2016.evtx.golden.json b/x-pack/winlogbeat/module/security/test/testdata/4906_WindowsSrv2016.evtx.golden.json new file mode 100644 index 00000000000..9711989c89e --- /dev/null +++ b/x-pack/winlogbeat/module/security/test/testdata/4906_WindowsSrv2016.evtx.golden.json @@ -0,0 +1,50 @@ +[ + { + "@timestamp": "2020-08-18T09:19:00.2372249Z", + "event": { + "action": "crash-on-audit-changed", + "category": [ + "iam", + "configuration" + ], + "code": 4906, + "kind": "event", + "module": "security", + "outcome": "success", + "provider": "Microsoft-Windows-Security-Auditing", + "type": [ + "admin", + "change" + ] + }, + "host": { + "name": "WIN-BVM4LI1L1Q6.TEST.local" + }, + "log": { + "level": "information" + }, + "winlog": { + "api": "wineventlog", + "channel": "Security", + "computer_name": "WIN-BVM4LI1L1Q6.TEST.local", + "event_data": { + "CrashOnAuditFailValue": "1" + }, + "event_id": 4906, + "keywords": [ + "Audit Success" + ], + "opcode": "Info", + "process": { + "pid": 780, + "thread": { + "id": 804 + } + }, + "provider_guid": "{54849625-5478-4994-a5ba-3e3b0328c30d}", + "provider_name": "Microsoft-Windows-Security-Auditing", + "record_id": 123786, + "task": "Audit Policy Change" + } + } +] \ No newline at end of file diff --git a/x-pack/winlogbeat/module/security/test/testdata/4907_WindowsSrv2016.evtx.golden.json b/x-pack/winlogbeat/module/security/test/testdata/4907_WindowsSrv2016.evtx.golden.json new file mode 100644 index 00000000000..32dd648fc2a --- /dev/null +++ b/x-pack/winlogbeat/module/security/test/testdata/4907_WindowsSrv2016.evtx.golden.json @@ -0,0 +1,75 @@ +[ + { + "@timestamp": "2020-08-19T07:56:17.1121901Z", + "event": { + "action": "audit-setting-changed", + "category": [ + "iam", + "configuration" + ], + "code": 4907, + "kind": "event", + "module": "security", + "outcome": "success", + "provider": "Microsoft-Windows-Security-Auditing", + "type": [ + "admin", + "change" + ] + }, + "host": { + "name": "WIN-BVM4LI1L1Q6.TEST.local" + }, + "log": { + "level": "information" + }, + "process": { + "executable": "C:\\Windows\\WinSxS\\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.1883_none_7ed84bd822106081\\TiWorker.exe", + "name": "TiWorker.exe", + "pid": 4300 + }, + "related": { + "user": "WIN-BVM4LI1L1Q6$" + }, + "user": { + "domain": "TEST", + "id": "S-1-5-18", + "name": "WIN-BVM4LI1L1Q6$" + }, + "winlog": { + "api": "wineventlog", + "channel": "Security", + "computer_name": "WIN-BVM4LI1L1Q6.TEST.local", + "event_data": { + "HandleId": "0x93c", + "NewSd": "S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)", + "NewSdSacl0": "Everyone :System Audit (Delete All Child Objects,List Contents,Read All Properties,All Extended Rights,Delete,Modify Permissions,Modify Owner)", + "ObjectName": "C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\RemoteAccess\\RemoteAccess.psd1", + "ObjectServer": "Security", + "ObjectType": "File", + "SubjectDomainName": "TEST", + "SubjectLogonId": "0x3e7", + "SubjectUserName": "WIN-BVM4LI1L1Q6$", + "SubjectUserSid": "S-1-5-18" + }, + "event_id": 4907, + "keywords": [ + "Audit Success" + ], + "logon": { + "id": "0x3e7" + }, + "opcode": "Info", + "process": { + "pid": 4, + "thread": { + "id": 408 + } + }, + "provider_guid": "{54849625-5478-4994-a5ba-3e3b0328c30d}", + "provider_name": "Microsoft-Windows-Security-Auditing", + "record_id": 146933, + "task": "Audit Policy Change" + } + } +] \ No newline at end of file diff --git a/x-pack/winlogbeat/module/security/test/testdata/4908_WindowsSrv2016.evtx.golden.json b/x-pack/winlogbeat/module/security/test/testdata/4908_WindowsSrv2016.evtx.golden.json new file mode 100644 index 00000000000..fcbdbce1d3d --- /dev/null +++ b/x-pack/winlogbeat/module/security/test/testdata/4908_WindowsSrv2016.evtx.golden.json @@ -0,0 +1,58 @@ +[ + { + "@timestamp": "2020-08-19T06:07:25.0461779Z", + "event": { + "action": "special-group-table-changed", + "category": [ + "iam", + "configuration" + ], + "code": 4908, + "kind": "event", + "module": "security", + "outcome": "success", + "provider": "Microsoft-Windows-Security-Auditing", + "type": [ + "admin", + "change" + ] + }, + "host": { + "name": "WIN-BVM4LI1L1Q6.TEST.local" + }, + "log": { + "level": "information" + }, + "winlog": { + "api": "wineventlog", + "channel": "Security", + "computer_name": "WIN-BVM4LI1L1Q6.TEST.local", + "event_data": { + "SidList": [ + "", + "%{S-1-5-32-544}", + "%{S-1-5-32-123-54-65}" + ], + "SidListDesc": [ + "Administrators", + "S-1-5-32-123-54-65" + ] + }, + "event_id": 4908, + "keywords": [ + "Audit Success" + ], + "opcode": "Info", + "process": { + "pid": 784, + "thread": { + "id": 808 + } + }, + "provider_guid": "{54849625-5478-4994-a5ba-3e3b0328c30d}", + "provider_name": "Microsoft-Windows-Security-Auditing", + "record_id": 140274, + "task": "Audit Policy Change" + } + } +] \ No newline at end of file diff --git a/x-pack/winlogbeat/module/security/test/testdata/4912_WindowsSrv2016.evtx.golden.json b/x-pack/winlogbeat/module/security/test/testdata/4912_WindowsSrv2016.evtx.golden.json new file mode 100644 index 00000000000..5e9a933c7bb --- /dev/null +++ b/x-pack/winlogbeat/module/security/test/testdata/4912_WindowsSrv2016.evtx.golden.json @@ -0,0 +1,70 @@ +[ + { + "@timestamp": "2020-08-18T14:36:41.2936839Z", + "event": { + "action": "per-user-audit-policy-changed", + "category": [ + "iam", + "configuration" + ], + "code": 4912, + "kind": "event", + "module": "security", + "outcome": "success", + "provider": "Microsoft-Windows-Security-Auditing", + "type": [ + "admin", + "change" + ] + }, + "host": { + "name": "WIN-BVM4LI1L1Q6.TEST.local" + }, + "log": { + "level": "information" + }, + "related": { + "user": "Administrator" + }, + "user": { + "domain": "TEST", + "id": "S-1-5-21-2024912787-2692429404-2351956786-500", + "name": "Administrator" + }, + "winlog": { + "activity_id": "{65461d39-753f-0000-731d-46653f75d601}", + "api": "wineventlog", + "channel": "Security", + "computer_name": "WIN-BVM4LI1L1Q6.TEST.local", + "event_data": { + "AuditPolicyChanges": "%%8452", + "CategoryId": "%%8276", + "SubcategoryGuid": "{0cce924a-69ae-11d9-bed3-505054503030}", + "SubcategoryId": "%%13317", + "SubjectDomainName": "TEST", + "SubjectLogonId": "0x44d7d", + "SubjectUserName": "Administrator", + "SubjectUserSid": "S-1-5-21-2024912787-2692429404-2351956786-500", + "TargetUserSid": "S-1-5-21-2024912787-2692429404-2351956786-500" + }, + "event_id": 4912, + "keywords": [ + "Audit Success" + ], + "logon": { + "id": "0x44d7d" + }, + "opcode": "Info", + "process": { + "pid": 780, + "thread": { + "id": 3300 + } + }, + "provider_guid": "{54849625-5478-4994-a5ba-3e3b0328c30d}", + "provider_name": "Microsoft-Windows-Security-Auditing", + "record_id": 123917, + "task": "Audit Policy Change" + } + } +] \ No newline at end of file diff --git a/x-pack/winlogbeat/module/security/test/testdata/security-windows2012_4771.evtx.golden.json b/x-pack/winlogbeat/module/security/test/testdata/security-windows2012_4771.evtx.golden.json index 6519408002c..977ea0fe116 100644 --- a/x-pack/winlogbeat/module/security/test/testdata/security-windows2012_4771.evtx.golden.json +++ b/x-pack/winlogbeat/module/security/test/testdata/security-windows2012_4771.evtx.golden.json @@ -22,6 +22,7 @@ "level": "information" }, "related": { + "ip": "192.168.5.44", "user": "MPUIG" }, "source": { diff --git a/x-pack/winlogbeat/module/security/test/testdata/security-windows2012_4778.evtx.golden.json b/x-pack/winlogbeat/module/security/test/testdata/security-windows2012_4778.evtx.golden.json index 649db8b0e23..f7944a0c686 100644 --- a/x-pack/winlogbeat/module/security/test/testdata/security-windows2012_4778.evtx.golden.json +++ b/x-pack/winlogbeat/module/security/test/testdata/security-windows2012_4778.evtx.golden.json @@ -22,6 +22,7 @@ "level": "information" }, "related": { + "ip": "10.100.150.9", "user": "at_adm" }, "source": { diff --git a/x-pack/winlogbeat/module/security/test/testdata/security-windows2012_4779.evtx.golden.json b/x-pack/winlogbeat/module/security/test/testdata/security-windows2012_4779.evtx.golden.json index 12c23f0a09d..93f89a592a6 100644 --- a/x-pack/winlogbeat/module/security/test/testdata/security-windows2012_4779.evtx.golden.json +++ b/x-pack/winlogbeat/module/security/test/testdata/security-windows2012_4779.evtx.golden.json @@ -22,6 +22,7 @@ "level": "information" }, "related": { + "ip": "10.100.150.17", "user": "at_adm" }, "source": { From f820bed3443996ccf31690e212579d831a78d5fb Mon Sep 17 00:00:00 2001 From: Anabella Cristaldi Date: Sat, 23 Jan 2021 18:01:53 +0100 Subject: [PATCH 5/5] Added related.ip type - Added checks --- .../security/config/winlogbeat-security.js | 22 +++++++++++-------- 1 file changed, 13 insertions(+), 9 deletions(-) diff --git a/x-pack/winlogbeat/module/security/config/winlogbeat-security.js b/x-pack/winlogbeat/module/security/config/winlogbeat-security.js index bee92e1e975..44d0e8eb34d 100644 --- a/x-pack/winlogbeat/module/security/config/winlogbeat-security.js +++ b/x-pack/winlogbeat/module/security/config/winlogbeat-security.js @@ -1850,7 +1850,7 @@ var security = (function () { {from: "winlog.event_data.AccountName", to: "user.name"}, {from: "winlog.event_data.AccountDomain", to: "user.domain"}, {from: "winlog.event_data.ClientAddress", to: "source.ip", type: "ip"}, - {from: "winlog.event_data.ClientAddress", to: "related.ip"}, + {from: "winlog.event_data.ClientAddress", to: "related.ip", type: "ip"}, {from: "winlog.event_data.ClientName", to: "source.domain"}, {from: "winlog.event_data.LogonID", to: "winlog.logon.id"}, ], @@ -2005,7 +2005,7 @@ var security = (function () { {from: "winlog.event_data.ProcessId", to: "process.pid", type: "long"}, {from: "winlog.event_data.ProcessName", to: "process.executable"}, {from: "winlog.event_data.IpAddress", to: "source.ip", type: "ip"}, - {from: "winlog.event_data.ClientAddress", to: "related.ip"}, + {from: "winlog.event_data.ClientAddress", to: "related.ip", type: "ip"}, {from: "winlog.event_data.IpPort", to: "source.port", type: "long"}, {from: "winlog.event_data.WorkstationName", to: "source.domain"}, ], @@ -2143,10 +2143,12 @@ var security = (function () { .Add(addEventFields) .Add(function(evt) { var user = evt.Get("winlog.event_data.TargetUserName"); - var res = /^-$/.test(user); - if (!res) { - evt.AppendTo('related.user', user); - } + if (user) { + var res = /^-$/.test(user); + if (!res) { + evt.AppendTo('related.user', user); + } + } }) .Build(); @@ -2260,9 +2262,11 @@ var security = (function () { .Add(addEventFields) .Add(function(evt) { var ip = evt.Get("source.ip"); - if (/::ffff:/.test(ip)) { - evt.Put("source.ip", ip.replace("::ffff:", "")); - evt.Put("related.ip", ip.replace("::ffff:", "")); + if (ip) { + if (/::ffff:/.test(ip)) { + evt.Put("source.ip", ip.replace("::ffff:", "")); + evt.Put("related.ip", ip.replace("::ffff:", "")); + } } }) .Build();