-
Notifications
You must be signed in to change notification settings - Fork 4.9k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
[Winlogbeat] Add Group Management Events - Add NewUAC Description for…
… User Management Events (#14299) * Added Group Management Events * Added User and Group Enumeration * Added New UAC Description
- Loading branch information
Showing
39 changed files
with
1,296 additions
and
4 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Binary file added
BIN
+68 KB
x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4727.evtx
Binary file not shown.
63 changes: 63 additions & 0 deletions
63
x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4727.evtx.golden.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,63 @@ | ||
| [ | ||
| { | ||
| "@timestamp": "2019-10-22T11:26:12.4955445Z", | ||
| "event": { | ||
| "action": "added-group-account", | ||
| "code": 4727, | ||
| "kind": "event", | ||
| "module": "security", | ||
| "provider": "Microsoft-Windows-Security-Auditing" | ||
| }, | ||
| "group": { | ||
| "domain": "WLBEAT", | ||
| "name": "DnsUpdateProxy" | ||
| }, | ||
| "log": { | ||
| "level": "information" | ||
| }, | ||
| "message": "A security-enabled global group was created.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tWIN-41OB2LO92CR$\n\tAccount Domain:\t\tWLBEAT\n\tLogon ID:\t\t0x27438\n\nNew Group:\n\tSecurity ID:\t\tS-1-5-21-101361758-2486510592-3018839910-1110\n\tGroup Name:\t\tDnsUpdateProxy\n\tGroup Domain:\t\tWLBEAT\n\nAttributes:\n\tSAM Account Name:\tDnsUpdateProxy\n\tSID History:\t\t-\n\nAdditional Information:\n\tPrivileges:\t\t-", | ||
| "process": { | ||
| "name": "null" | ||
| }, | ||
| "user": { | ||
| "domain": "WLBEAT", | ||
| "id": "S-1-5-18", | ||
| "name": "WIN-41OB2LO92CR$" | ||
| }, | ||
| "winlog": { | ||
| "api": "wineventlog", | ||
| "channel": "Security", | ||
| "computer_name": "WIN-41OB2LO92CR.wlbeat.local", | ||
| "event_data": { | ||
| "PrivilegeList": "-", | ||
| "SamAccountName": "DnsUpdateProxy", | ||
| "SidHistory": "-", | ||
| "SubjectDomainName": "WLBEAT", | ||
| "SubjectLogonId": "0x27438", | ||
| "SubjectUserName": "WIN-41OB2LO92CR$", | ||
| "SubjectUserSid": "S-1-5-18", | ||
| "TargetDomainName": "WLBEAT", | ||
| "TargetSid": "S-1-5-21-101361758-2486510592-3018839910-1110", | ||
| "TargetUserName": "DnsUpdateProxy" | ||
| }, | ||
| "event_id": 4727, | ||
| "keywords": [ | ||
| "Audit Success" | ||
| ], | ||
| "logon": { | ||
| "id": "0x27438" | ||
| }, | ||
| "opcode": "Info", | ||
| "process": { | ||
| "pid": 772, | ||
| "thread": { | ||
| "id": 1664 | ||
| } | ||
| }, | ||
| "provider_guid": "{54849625-5478-4994-a5ba-3e3b0328c30d}", | ||
| "provider_name": "Microsoft-Windows-Security-Auditing", | ||
| "record_id": 4105, | ||
| "task": "Security Group Management" | ||
| } | ||
| } | ||
| ] |
Binary file added
BIN
+68 KB
x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4728.evtx
Binary file not shown.
63 changes: 63 additions & 0 deletions
63
x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4728.evtx.golden.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,63 @@ | ||
| [ | ||
| { | ||
| "@timestamp": "2019-10-22T11:33:26.8613751Z", | ||
| "event": { | ||
| "action": "added-group-account-to", | ||
| "code": 4728, | ||
| "kind": "event", | ||
| "module": "security", | ||
| "provider": "Microsoft-Windows-Security-Auditing" | ||
| }, | ||
| "group": { | ||
| "domain": "WLBEAT", | ||
| "name": "test_group2" | ||
| }, | ||
| "log": { | ||
| "level": "information" | ||
| }, | ||
| "message": "A member was added to a security-enabled global group.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-101361758-2486510592-3018839910-500\n\tAccount Name:\t\tAdministrator\n\tAccount Domain:\t\tWLBEAT\n\tLogon ID:\t\t0x4A727\n\nMember:\n\tSecurity ID:\t\tS-1-5-21-101361758-2486510592-3018839910-500\n\tAccount Name:\t\tCN=Administrator,CN=Users,DC=wlbeat,DC=local\n\nGroup:\n\tSecurity ID:\t\tS-1-5-21-101361758-2486510592-3018839910-1112\n\tGroup Name:\t\ttest_group2\n\tGroup Domain:\t\tWLBEAT\n\nAdditional Information:\n\tPrivileges:\t\t-", | ||
| "process": { | ||
| "name": "null" | ||
| }, | ||
| "user": { | ||
| "domain": "WLBEAT", | ||
| "id": "S-1-5-21-101361758-2486510592-3018839910-500", | ||
| "name": "Administrator" | ||
| }, | ||
| "winlog": { | ||
| "api": "wineventlog", | ||
| "channel": "Security", | ||
| "computer_name": "WIN-41OB2LO92CR.wlbeat.local", | ||
| "event_data": { | ||
| "MemberName": "CN=Administrator,CN=Users,DC=wlbeat,DC=local", | ||
| "MemberSid": "S-1-5-21-101361758-2486510592-3018839910-500", | ||
| "PrivilegeList": "-", | ||
| "SubjectDomainName": "WLBEAT", | ||
| "SubjectLogonId": "0x4a727", | ||
| "SubjectUserName": "Administrator", | ||
| "SubjectUserSid": "S-1-5-21-101361758-2486510592-3018839910-500", | ||
| "TargetDomainName": "WLBEAT", | ||
| "TargetSid": "S-1-5-21-101361758-2486510592-3018839910-1112", | ||
| "TargetUserName": "test_group2" | ||
| }, | ||
| "event_id": 4728, | ||
| "keywords": [ | ||
| "Audit Success" | ||
| ], | ||
| "logon": { | ||
| "id": "0x4a727" | ||
| }, | ||
| "opcode": "Info", | ||
| "process": { | ||
| "pid": 772, | ||
| "thread": { | ||
| "id": 1664 | ||
| } | ||
| }, | ||
| "provider_guid": "{54849625-5478-4994-a5ba-3e3b0328c30d}", | ||
| "provider_name": "Microsoft-Windows-Security-Auditing", | ||
| "record_id": 4657, | ||
| "task": "Security Group Management" | ||
| } | ||
| } | ||
| ] |
Binary file added
BIN
+68 KB
x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4729.evtx
Binary file not shown.
Oops, something went wrong.