From 8e31628955f89ab550e33a1ae1cc750b850a29ab Mon Sep 17 00:00:00 2001 From: Anabella Cristaldi <33020901+janniten@users.noreply.github.com> Date: Tue, 17 Dec 2019 17:15:24 +0100 Subject: [PATCH] [Winlogbeat] Add Group Management Events - Add NewUAC Description for User Management Events (#14299) * Added Group Management Events * Added User and Group Enumeration * Added New UAC Description --- .../security/config/winlogbeat-security.js | 142 ++++++++++++++++++ ...2016_4720_Account_Created.evtx.golden.json | 20 ++- .../testdata/security-windows2016_4727.evtx | Bin 0 -> 69632 bytes ...security-windows2016_4727.evtx.golden.json | 63 ++++++++ .../testdata/security-windows2016_4728.evtx | Bin 0 -> 69632 bytes ...security-windows2016_4728.evtx.golden.json | 63 ++++++++ .../testdata/security-windows2016_4729.evtx | Bin 0 -> 69632 bytes ...security-windows2016_4729.evtx.golden.json | 63 ++++++++ .../testdata/security-windows2016_4730.evtx | Bin 0 -> 69632 bytes ...security-windows2016_4730.evtx.golden.json | 61 ++++++++ .../testdata/security-windows2016_4731.evtx | Bin 0 -> 69632 bytes ...security-windows2016_4731.evtx.golden.json | 63 ++++++++ .../testdata/security-windows2016_4732.evtx | Bin 0 -> 69632 bytes ...security-windows2016_4732.evtx.golden.json | 63 ++++++++ .../testdata/security-windows2016_4733.evtx | Bin 0 -> 69632 bytes ...security-windows2016_4733.evtx.golden.json | 63 ++++++++ .../testdata/security-windows2016_4734.evtx | Bin 0 -> 69632 bytes ...security-windows2016_4734.evtx.golden.json | 61 ++++++++ .../testdata/security-windows2016_4735.evtx | Bin 0 -> 69632 bytes ...security-windows2016_4735.evtx.golden.json | 63 ++++++++ .../testdata/security-windows2016_4737.evtx | Bin 0 -> 69632 bytes ...security-windows2016_4737.evtx.golden.json | 63 ++++++++ ...2016_4738_Account_Changed.evtx.golden.json | 16 +- .../testdata/security-windows2016_4754.evtx | Bin 0 -> 69632 bytes ...security-windows2016_4754.evtx.golden.json | 63 ++++++++ .../testdata/security-windows2016_4755.evtx | Bin 0 -> 69632 bytes ...security-windows2016_4755.evtx.golden.json | 63 ++++++++ .../testdata/security-windows2016_4756.evtx | Bin 0 -> 69632 bytes ...security-windows2016_4756.evtx.golden.json | 63 ++++++++ .../testdata/security-windows2016_4757.evtx | Bin 0 -> 69632 bytes ...security-windows2016_4757.evtx.golden.json | 63 ++++++++ .../testdata/security-windows2016_4758.evtx | Bin 0 -> 69632 bytes ...security-windows2016_4758.evtx.golden.json | 61 ++++++++ .../testdata/security-windows2016_4764.evtx | Bin 0 -> 69632 bytes ...security-windows2016_4764.evtx.golden.json | 62 ++++++++ .../testdata/security-windows2016_4798.evtx | Bin 0 -> 69632 bytes ...security-windows2016_4798.evtx.golden.json | 58 +++++++ .../testdata/security-windows2016_4799.evtx | Bin 0 -> 69632 bytes ...security-windows2016_4799.evtx.golden.json | 63 ++++++++ 39 files changed, 1296 insertions(+), 4 deletions(-) create mode 100644 x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4727.evtx create mode 100644 x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4727.evtx.golden.json create mode 100644 x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4728.evtx create mode 100644 x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4728.evtx.golden.json create mode 100644 x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4729.evtx create mode 100644 x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4729.evtx.golden.json create mode 100644 x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4730.evtx create mode 100644 x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4730.evtx.golden.json create mode 100644 x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4731.evtx create mode 100644 x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4731.evtx.golden.json create mode 100644 x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4732.evtx create mode 100644 x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4732.evtx.golden.json create mode 100644 x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4733.evtx create mode 100644 x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4733.evtx.golden.json create mode 100644 x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4734.evtx create mode 100644 x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4734.evtx.golden.json create mode 100644 x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4735.evtx create mode 100644 x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4735.evtx.golden.json create mode 100644 x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4737.evtx create mode 100644 x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4737.evtx.golden.json create mode 100644 x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4754.evtx create mode 100644 x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4754.evtx.golden.json create mode 100644 x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4755.evtx create mode 100644 x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4755.evtx.golden.json create mode 100644 x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4756.evtx create mode 100644 x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4756.evtx.golden.json create mode 100644 x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4757.evtx create mode 100644 x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4757.evtx.golden.json create mode 100644 x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4758.evtx create mode 100644 x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4758.evtx.golden.json create mode 100644 x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4764.evtx create mode 100644 x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4764.evtx.golden.json create mode 100644 x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4798.evtx create mode 100644 x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4798.evtx.golden.json create mode 100644 x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4799.evtx create mode 100644 x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4799.evtx.golden.json diff --git a/x-pack/winlogbeat/module/security/config/winlogbeat-security.js b/x-pack/winlogbeat/module/security/config/winlogbeat-security.js index 6a8dda197de..13ef413f9e5 100644 --- a/x-pack/winlogbeat/module/security/config/winlogbeat-security.js +++ b/x-pack/winlogbeat/module/security/config/winlogbeat-security.js @@ -19,6 +19,34 @@ var security = (function () { "11": "CachedInteractive", }; + // User Account Control Attributes Table + // https://support.microsoft.com/es-us/help/305144/how-to-use-useraccountcontrol-to-manipulate-user-account-properties + var uac_flags = [ + [0x0001, 'SCRIPT'], + [0x0002, 'ACCOUNTDISABLE'], + [0x0008, 'HOMEDIR_REQUIRED'], + [0x0010, 'LOCKOUT'], + [0x0020, 'PASSWD_NOTREQD'], + [0x0040, 'PASSWD_CANT_CHANGE'], + [0x0080, 'ENCRYPTED_TEXT_PWD_ALLOWED'], + [0x0100, 'TEMP_DUPLICATE_ACCOUNT'], + [0x0200, 'NORMAL_ACCOUNT'], + [0x0800, 'INTERDOMAIN_TRUST_ACCOUNT'], + [0x1000, 'WORKSTATION_TRUST_ACCOUNT'], + [0x2000, 'SERVER_TRUST_ACCOUNT'], + [0x10000, 'DONT_EXPIRE_PASSWORD'], + [0x20000, 'MNS_LOGON_ACCOUNT'], + [0x40000, 'SMARTCARD_REQUIRED'], + [0x80000, 'TRUSTED_FOR_DELEGATION'], + [0x100000, 'NOT_DELEGATED'], + [0x200000, 'USE_DES_KEY_ONLY'], + [0x400000, 'DONT_REQ_PREAUTH'], + [0x800000, 'PASSWORD_EXPIRED'], + [0x1000000, 'TRUSTED_TO_AUTH_FOR_DELEGATION'], + [0x04000000, 'PARTIAL_SECRETS_ACCOUNT'], + ]; + + // event.action Description Table var eventActionTypes = { "4624": "logged-in", "4625": "logon-failed", @@ -32,10 +60,28 @@ var security = (function () { "4724": "reset-password", "4725": "disabled-user-account", "4726": "deleted-user-account", + "4727": "added-group-account", + "4728": "added-group-account-to", + "4729": "deleted-group-account-from", + "4730": "deleted-group-account", + "4731": "added-group-account", + "4732": "added-group-account-to", + "4733": "deleted-group-account-from", + "4734": "deleted-group-account", + "4735": "modified-group-account", + "4737": "modified-group-account", "4738": "modified-user-account", "4740": "locked-out-user-account", + "4754": "added-group-account", + "4755": "modified-group-account", + "4756": "added-group-account-to", + "4757": "deleted-group-account-from", + "4758": "deleted-group-account", + "4764": "type-changed-group-account", "4767": "unlocked-user-account", "4781": "renamed-user-account", + "4798": "group-membership-enumerated", + "4799": "user-member-enumerated", }; // Descriptions of failure status codes. @@ -1104,6 +1150,28 @@ var security = (function () { evt.Put("winlog.logon.failure.sub_status", descriptiveFailureStatus); }; + var addUACDescription = function(evt) { + var code = evt.Get("winlog.event_data.NewUacValue"); + if (!code) { + return; + } + var uac_code=parseInt(code); + var uac_result = []; + for (var i=0; iO!>k;*R$Dk>-n1u1e71O$z!P!+2d>jhh|+UoP?f4|xD?aYQj3Q zd(V5`^PTUUIcGAoXi`>TQ32Kc_|%SSq#DH$rD=6f`Hz36ol*PRe|(eJ4Pp$$7>F?t zV<5&rjDZ*fF$Q7`#2AP%5Mv<5K#YMOWMF8~q`{L*rl5}>`kXGU=EE2i7}%I-QR1p| zLTB6mpY4p@KVyaY4y^-3-!&pS5l?i?Z$3iQK7ptoh9Q3JXWtK8^B8RMr!{Qy=WBKT zt7<>*TZ(;?>fjlG-`}V~lC$dAC|394YadhFqi}8(?)hS!`|vqVe9l)`&9-X5b*D}! z(?lNQQJ2TkEuS{sW7CGUwGMmsN*yIfI z=f&iB8cH`(0hLfCe$T}>aDzIyDK(y|sF;dyumT6-wVpH?r&UrJT}oZ?uYx9GPXW%! z!*&;>h1gS0rTA4!lW=Ai{4T}*t~3qDN|0Ve-SDpmwz^So{9h0@UlH-kr`6V;L|I9> zm5vQiE=|XsD|L$ycxG+wPk~EH^zSngXpC7S>-s|3*Rge7io_KMkX)`jt48N~v*~aWo32-K5U=DzA}=tPwN>$2#B}V9D`qI=+)cSKt8qew?0wEi6DWo4-vp7i%5%ETQj0i4xRiJXS+8*D_W0d@*p>^-+PAvPVl6X)qP z7p1UVYHN#OL!8Kl^@+$pl@5HWZYWf|!x;xklNd|Vp+u$Gi8!$W{}hS@N(iuP<)Xc{ zPXZX8thf~df{Bz6r={s~VrR^sTOiTFI5Q7ID$#Lsp{0@L*J^8Z0&pT1T;Gxeov30+ zfx(69iZ5PkMOOnt4rQQJ3v<<&um@gJDHlr`GZZUou8WGR7g|*Ldj^*Lb*(! z7L-6ua1>PlTl`I+B>g;nC;rRAuQW=S)n&l7iCJM^y$J59gr?AK?ay6{;jwK8mSJIkLTH?yR~T@TTVAP@W5 z6Anen?Jg_px21k~CoUj9dLF(3_JHwPP>g&aZJb@bcAs6(c#@xH>W7>ReoxPrei%HRJOyR_90H%mt^{(+#?Q45V^pTPp?sgmRdQ^0B(oKnX#y)jsOl3k{S_>RfA`%lOds^+25smVSwE3B=9$4TPL$cV+op z!*Yu51VXN;2zlo6$p%Z@*!fZ#eXm7s&Dblkdz=bem8KF&2wll}r{;lJ^S^e;p8 zy+d}Kj&06ueZ1TV@WD}1Im(uGS)hA94)%)huYBG$-TNF;gKsEwmlm)K%B!w6*!QsK;n2Sbo`B;IR?08nm8MZo{OXRV3_HD7}V0{@lvw?#>B6m{wqyJ|8u#Q+yzteXUO&FY%cn?bP$Lh#_Jr;{rI!Z=8 z7G$o~k##*ry_R~s9Q@y<_@7&t_kQ&F@1xh_$q)xS75y_%EHoAF>Wa4-1qYK3_P*VLgaN(Zdpx9_And z6J#+xL{Sf1`kLs0-R452hjA0`i=rOxx9|^QQS?v}jPwtJ%oBRZ{}KKnH2TFI{}Oz^ z-w#Bd%W?S+`-BWGcZr`Csq%kj%a`BSX&>yzPh#S;PHVKvB%+tWyC8Ed?{0{TXh!;m zYt8N8JxUK#cHEm4Jv~^pgJMziFyO67JqR*S=%FFCgZc=G_=9^@`QNpENfgW9s-Gkl zrTp)B$0+|*$wY$86XoAf`$_r(Z}A7!XeaJddiXZ+& zaS?jG%)7*;OBDYT`fVKTEdOFr0SG7DK68B(WFF(6?ta+J|NSc83(Jo!a+ZIw=u4*H z6;Q+kg@pNEhp!;>82_C@Y1ox3uFPXZaV4;(u;A9@!oVGLP|(=}u<-FID{a z$r|vPv;2!i1t6S={so!G_{W&2ng0h=zQ;|R`Kt{!`e*jrU$Gb_UTrY{+&>d!-sb;7 zmFwdNN@h9BzgV>5-;efJka?GX9;aBQvVZpBV-5fJ7W!p^%(eWR<0GE8`4fEY&!znSc>~d&w;7s0 zUWvI(Jg>A!7fpeA-sVcBqufbtzO|zx`+ig`Dgfbx>+uA91(|DgR4+gJKPul(+_n4M z?Kb*3_W2i!FZtUI3BaRl_~N0jJ^>o$KObK~<}vek}=3&Y{kFN_d*Ya=nqYd?WBd?k{Y3^sPQhGRg>6%^6>Om}u9(HUo z^w1fa5M(huM6sV4p$G17Jf`$;@J8*G=;^_#pD7ka4|#ty^uYc>kaIdYQ=w_VMq5k%fDFcizVLXex|g~g3M$5 z(~+m8pULSO#s7h0Gix8R5g*ytzgQIgkJxGWzqS}>5o8|Yzfn_G?XZr-qUdPx;Yb|`vY3wa)qwxM<8^h{S?liwknuWB z*D4*wHCyz+BR1ND`uQWPabK}0I(qlhNF50>&*;c&7pKa0>r|%wzmx zoX^bvvnu=D-aYFJXZaV4!oQ>vR|_(a@sHYW=6{{a_NdY4G=0=j|05QKcS)sRFUY*j z|9X|}rK^^H;w=ASQFxb>`JV~@FUY*j|8pwa2L?Xnd(2V&hb znaB7?Ud{Y(RQy-A9KHP+NBI|vE%9nl?*C3uNLc@E(}@I`$N0zlwaol)Qn`NozMO}j zb(DXxr~rf$=6_BLB0=Uc{_#dMGyi{7`CfL>x_!>_FBZeZs}12_ka>)Mt?7I-|C?2= ztNwZS*Us`U7Ei~&AoCdi$gY|HEh_ux5A8R3oumFoEL!out0j>j^BDg}Z(At*^E$tm zRQ9+0C2>LY__tbDDHiMUpNzFTynaWJxt9OPb(L60XI@viRb{(&*d1Eq@ZUSB|NFM< z_x#A}{W@ZC>VUF4lI9WZAIWKrmJQAy!B>#EmUr{>?1nnuHDVnd*T+98Jv>^mE6$D{ z>^}z*i$i@h3`?5BPc~T((@k=K03kRrwEDoY}}u`P=u$Vo?DIC(=F(GS`;BwLdn!?}q0` z>`?jk_w3rj4*&J5e^>#G=%{jn^9WZ%EKU=34&E{@82t{q(1gZnoHllJWWPNSi{XYqZE$y$5EjZDND}`nAVa;}v2tWyeSPO)y?@{2-?_+Hz?BW%Q2(nQQqsx5o{2yn+S~ zcso`4N1X0adN}xg>vhiRK`e?M-m5Y6um+kCWHCKNaeXfJzBG^~dSJKss?x)f%u!L) zgH?Z7EQ%g}`?{eA_78&06MAS!{pDun{_GS~9& zhWNAs?FB&yH&)ouQT@h$t>*EI#WcKG z!VeT<6q4^S*3lV@8wHtbbrd;|zl6G*=kdRzayzqa#hZ3`w;%6`#inJC+}|9}#e2=< zv_^X%1%C?%^;eL&mUlOdJL>aHCEnxbVTY9-in>4gZuInE^&C_ziXQ%1M-PI`6MAS! z&q2d~H=CbF98u+eWcE!*?UaB0{BSz{9*B=dq>oI8$-uP#$Itw~r}DjX^NP#U9pzsvhKW}j%stP)}UGFUaV$q8Kb>Lr+d5r%O`9)ciq zE$?oK1B&qu>2h@P|W&wRTzCwh9Y>X(T{(L;~@k$Mnhp3p;s?3b|)K2+tu<==mb zV)Z1ZD1iR5_ydlMK2mzvd*#V7cKm_;et}q20Ky5k z4`0R^$Xu%j>wdv-DmBNYAFF(~Eh@OuS^mZ1{Y3Xe2;ujB3jc!4WBgZAhVakz;IE4R zNpm({vCGl;NGys!eDi}ye<;XY%fB1qBYmB;_(M*QDLq_z^5a}*^&l2S57&GcsRuz8 z(?b-WOJ78lR3&=g=hB}jJ-kz~Zd~;AVD(&DEQ%i1e-x<)LFNfPc>1|C>*;SwM;(Ue zmPSuUR&lpj6desZ7O5ja<_R4&*tmNF%3u5n#~+_6J@k3t&g|Vb;tu<9w^&pF!U@NH zcj8?Ng3Psgu#UTtPl@|D{Y>Ti?ho6??QxWUu_*QN{Bt{o$HllGEXX{@e=!vc|2#hV zx#GWSdQt!A@ozOAEEa|T$sI!cH%Fhd8}u*8T+4stcrfPo%Xn~aOiTJg@&0+=cefh6 z-#%`c|2Flab>9Bq&0BLfO*-7S-zyW^ve!z*D$mR&?tRG0w_(wnO*R^6#KiPEfs ze*xj8gg8=(JD7j@wA$L4(9Soo?8~gJJsU92La8-Hn$-^*!60dY@w|~rsd1Tcgx8nT zP56y!MS-P!z)t~RFpdI#tuevj(LU_-1sjv!j~nxjuk{^puYS#^?`Q?qd_f;yqUk#Z z=sPq%BVOMzN#7AqE&Kq*U>0JBZt_KJ1OwD0PD|3yJf@$CZ9bFXw~klvv#=3tM5%#d z-bi8ip)($nGxqU;1WE{;;EhB|h||*ao3;)xz%19ov*qb*J#nhgF#!LF^JZs->mQL;9X z{ROWRL-EpaB>Wlo(A<|#^&2eu|Aro{o*Rfo(ZgTs=s}QqLJtk;xj`P6yQ~xZQZId? z*%SX2#qzi6zlcRC|EfKa{y>m&LLh;}JjQNSLhWn2a zNB?kpXkY(gaYL8iKGEux6T_a`dELK$F@M@t;a`w>lYey3Sag1fFW1+h8k>dTem#%Z z-XP_&ve8RL!)o+(M#lz?{x$jkXTGiVckoWUeh2j$6+} zB?rso#qruaS-;Hwb&AqaqbJXaE4HB{`}JEaDgfbxb+ijQ5@fE`5w~xLPp!v!;d;#D z6-6rF&!+Vn6+Ql~#)rhB)Z?KyhU)PVa6cSnAjn+HKaUR$9u(FUg~x|@q^DTz-@mq^ zdx;I*+wb>_#T8G^`e`xzXQvl9txjlL~ zs|T?tdbshAh8|i$6M`(JhbTS|AJZAWSoFXxf2q<#o4;HVMLk%J1Bpe^!`?dnL6CVu z4-IJ?h=+IeaUhP1%2fGxc)s-|cKm_;xJWE20O5q&2lfYo%(dlznz*PS92YVFzf$?u z3QHa4Uo7?@>d_1+7APdbzaaA(|HgA;j!Vl`uD8Aa$*}0@-zqK@i=*Qx8_%d{xk8eR z$3Yihq+XD@mj60&X+cC>%8wlR^I+SFcdm9cE)|RKO`Uq>YQ&{`W^r1h4dK23{Ei@V zE$?oKOZ_y2@+1!7v@#?IT6sa*d}s9_7DW#`XB&EW1ey?JF+D^vF3m&n`$P{MpG;MH z_-?`_QPhJ~Tq+ht4^_W0^uYc>ka zE&tQ>4~*ye%>OKv?|0r^bYQKG_SruFVo~bfn9fH1V}C5jJjOqkP)K~l>2DPONA@Od zf7((0#p3F{8!!EA+|whMFUbGtS94eXg!TU+zJknS{DW^Z|J92Br?kJl@T{Z!i^XPG zwSmAW+&>fk1(|pG=XqVT75}w!I&QYZfBpIgf5!Vr{nS6bzv+FXVp06h_L~g$~;FyX%yogQzzR$5tVRXp3=v zLFQWiBcH$GiJPn&<^J>>#rx`QH#c9DAFX-SR_lMn;`$9a?H1+}t=Pe7jW!;fC*%E@ zg3PtNoBd})ofpU}L?fQR-m3KQ;KuXPoz;U_6g?bz#n8iWtUnQCF+D_ce5C?SvibSz zZAuTNyB^k6lS_e=Nwn#(%NSf4ml?Omtt$=qhw= z@UmSRg$_-={>BVv)}1A#^nPM7;vw;WRqsXmzuTo?@U{y6#J9kI`rrL*-*fS#L&u*z z3HgjdKPd7w9T|1{Mj3dQMBP4I2IcB6`zS)ct$f}!-TN^(cPVZb}lg?ChNH ze&@UAo_pucWKcnV#>9d=s{Zn+9Tg}wiX%$Xsvq)Se@;8A>b3v+B(W337>F?tV<5&r zjDZ*fF$Q7`#2AP%5Mv<5K#YMH13$>Xpo07X6N)Bbj30WPuB_m%F)6U1E>W9i7j_OE zZU29^GwPO{E6itT8X)?<4$+BtqGNvZH$*KHhW)B{lIS?g-w1ng-w2at&V?1 z?dN?2#@qb>}d}+idpH@|M z6220@6^{;3Hci8s%XEtnc)zNuUjUbQ^vmf9G*Y*IBW&g3s1khJ4etyQ;}v)NDGOi= z@g-3(NLpa5(nIS;ei}?u^k3quR7#EO7e~W!*iGt)uX5^`$Qnum@m(vt11vc{P3w1( z=t`U-2b4`j^(X2On7W{!0={4z1^ilF`WbeJ($7k)Lu1ro6TwswzVij^lHU&>H^T>! zc<#P<%EW=}s{;KX;)8tD1Rt6xoerArr_s7ECh3Rx*q}zu@qwEFzn*9opb>B&yM-xY za~hv1o?7CAw457WO`t3A^)&dc7(C{JcRnx{NPJkR&e-$Lx-dFX=X3xL%>w{- zQ7(?r>ETwyn!0>?QiKQPN1!J__2RT7sKtmS8F48lwnyQF44ILHnD+&fD2cJm!H*;$ ztoUbL8lWG>I0|$mLhG+^Tt9l|)^O=2ub2NRWM$K$|K{8K0rC?UY1 zm0dfhM*K;m_NW`M3jo!PpocQQ4I^9Sou3qRGzp^&EjhLX{t zg=(2VjVOWY;afBTZ1FpRlJw*Bo%k;UpVBB5Z;iIawZI-j+=hC zxB@5bq`pCOuO7hKfe#K`xv1w2>z<4yV;UK$E_g_gk68cg=G`p|0I>))jFA^hu zk&PPWk}pN027LS_>i7$cMYR zv9DJ|{E&S{6hS}4ulPpz@7h&K0czQGasI*M&z#fnNBT0_0aTT=|C8I^<|5Tb1TC;$!(YH9XxtVZcWZOT1C>Upw$j~4#H>W zAQkGNxerO!%J0Zs)Bu&?8v3aYW&2uH5LI=f3hd$hcL=DwL)CKD!b3V6KbHU08u9;E z@b9PI>Ag+-i^cUDvRW+6C0ci!%Sui77i4EtTTR&dU-3Ww!8X0lMK{8NT?H>R!#k9^ zOApu{{;IAGPR)1(!L70Yt&;N(R?2ng{ijk_eCmX(q%)2vN1~O7ebYcLM~>>l1^c$B zT2I{`aUlmWq6ju7=z`Hdvwm1dtfxOH9gQ21lz2D1_+xcsza5K3D;*`H9Sbto>d3ks zqg_ioUJm~6RQ%7KnDbur`0t^&;|UNO2NnI*S1i`26kY1$)E5oGeP6r zrA3?-i_$(;r;O0!Y)1fI46K68wf-^3*~t(l$JtZ+h4!b!v~0w(P#?@=%gNa0u@%qX z@BnfM;%_KJI#b;3hu=+xYa>TCr^ZV?9eXJ^2IlH`Um^@lUO`gAC4lMQ%JafNJjr4$Xx4x>-t{=fYl z!~d(2i3FJ^{9jwgN%{qEi3b(vC+<~x_%89_P&@I!eqJONt@KcVK0=VWRu9&B5k|et zyX2)y6#wITZ5-h&|6)-A2p8Nxb9)qI9^;?xddSTGeX8CIOO7pamVdG6OQztJP{cTe zg!x~Gw;=Nv|7}9^*`ohHs#;&LwDlfm`4@{4e{MM**&hiqkMWP?PG*M>2 zW;)BiShV8bkN#JXd6$2lr&y+{f7hRmz4m<6^lvpUBo-z9ueey#=O^C7HKyj^Uy!+$ z|HyeEtcx(u3q2^UeM+0N|MJ@(e?8g$yil34*yQr6ZCig!v~@6-mD=U0m=gl;g3PtN zyJ234*F*kX#(`WeS9+*_{JV3V)q_|RJ!~3g=wUMEXa!kJ4^g~c7NG~eZt{@Q!>ajh zn?z3!R`Y~nQS?wW#LxrB2SMfuJ=CUo!tv(oWh<2bcm82(GdupbpO=b71t45-|G@D; zkh#|X*7HK>pUvZfKdE{j+&}C*XZaV48CaT*1TDN?LHHMB9^)V47yfzO-NTCicV3Gx zx5IzU@}r{`>jlK3#J|+hM*MpV<1#_!TK>)X5wF|)8Q%8SQl5F;K(yCwhHm02!&)X@ zS6ZNpCeOTXbEVQzc7C((?C8jT92JWSK)B#`JPvO`=2{)qD31Q0s`uk}?mmCJjd6~B z{>9>p{uToRh$tIAfAFi1frk0d#aobhjDJ%c<#EL$ivRj=ciXmXrjz4Lu~_l+-nq+W zVg=YHE-STpShCOa>w?U+{F~!wZN1*8-w$IRXRcCuIC|NdUC!!3EQ%g>Y%%oE7Mc)b zF+D_aoEf199&bFV^l;!t?d9m{!D^f-7DW#^e>U{M@j;MzLJzfRoLOWZXFjI-SglIwIE5lS)T7H{0#7j>MwqXz`&)9SO3Sj`X_$|F`pX)$g;`p9>)KbzH7hI*Mzs z=>CUo^anMIM^^K`Vo`K-BH>YGKrv1sk@zFXJjOrrdUO1F zPSv_&zulS6@-G$@fbjYi(Z3+`82@7s3FQw>Tka>)MJSfi0 z|MRNaZ#?%9J?3cq5sSjRl)}Ft^BDhlo}rol7gV)-1!qrM<0$`PF$oB);=dsC82_lN zng5N7|FXs-wm%VzAks$LJ|9HNZng30y){otr_0Thp@-G$@ zfN;V5&u&B{$UMeBo``1V|Ie!4%Q~;y=PdtXF-*ML5dH<3$N1Ok&o}eGS=GAyUw3`& zEdOHhbo>i4kMWP{n)%$6A3bp@qhHzg~C7I=l7zj{+7Qb zE{GogR`*qk#p?VgpSNAJ>ql14 z*Aa_T`b@q(X&%w5!?>)}GQs)7cndPu@@~GKU0c_?M%+io?eQ;4508}YinF5!``3ZQ z;vgRl#x2d^E1Rr`v3LtI*XqIgI*{o;DqeTIP4PeX@F%wTx8EMcqO`}0M;h&MEY|-E zGS~9&hW4mG|6kUh^KkGbrH3AEQv7z>W6ktnwcc1PiXI9x4Lxvt7G$2#LoU_)Inj~N zc0Kd@kjP_e_8iz^^Lpd$%Krlw_p4*a|MugtSX2PQh4jyY%(ecvj>o3w-SGN|9je~` zt{ocL;lF0>&uYD&Sd{j+@fxH34GbE{T+6>X9(!%QpZ@o(WPJ^nJC%;kzNYnA(bJLD zIxVp%I_jQd=;&97d3l3KrLmSg3Fgxt;bI3zb4Jbc-cPxVzC)k5+k65uM^1lNRWAq|Mz~GBK&h+yj$_V zcmMRY^=$B8v;Np>zCtXf?D#OZ9_A~KAKP%m zh|4`n4+q|By3ScWh(*!EyOo9>)<6@2ET)Gj-k(d|FAJoJ9ylz%qV%w&-|#5v!D_rL z7DW%gf8Edn#|J^?2|d)N@p1$6czLh#|Lxo7K4&K$*zcdkqLu$QL79Tgwf?uxkA`iT zCH*s(`xO6wd|>kp^=~jDIb19m}h#)-zw7G^2r| z{EI~eAY3s2tbak~G5*_Aw&p!=ci&(;?MkVBl{mg=34&Uke`;~ zIi=Z>k8rtP>0$A0Gd^=x4`NaDaGv&2c)W59`G_Ek=^={wDeGZ?Sq}%49u`br?yw%j zqUd3IT%;ZZSxgU6)C0Vaze0|K(_&(Zh!ch91_U&lY4cJw#Ct z*RDzmg!RDJ3Eoh8xcI?+Uqnw2R@Vu{qUhmINs)RGWS-E27oX!k*P;ZRzn9t2rT4^h-Z#NVIie&a2rhi=CrG ztnv=AD0--0-_Qg17lO&o9&I=bMMjiq*URI~YCt9AThF%3_a@B_t2 zh2(q8b+pCJje^XzI*MG!UqqeE>-gVMwVlzt^i4aw+t2sJV*SYv-`5b=#kC9CEw%gVTY6+3OYS!9Jk zo6XlF4lDm3o^{hvJN~a(98SmI1M$(&^kL~R8G7{)?XSwf?uh4my>lnXd!= zRnhT&!Ogb#w;zwiqVV5wmJyFPASMek*YfX%c#Nl;7~^l&#Sx{4Kjdb7+Q`OyjQ#c~ z78QVSA^o!;bFCh%+oNe6KlA^ts`t*#E3Qa)lz*`pCSGkY|J)u0naB7?4lePK%lA~R z2e5k3B`#${r$I{%w6Ht3FgK#;kX z|HyF}F7TPhW$&wMmu^0A#ZDV>$9^6l7RPMAD19f!WhMK#tkn8qEc`u22!hPDyt^R} zD8w_QOU&c4zbQRD{oU5A=;^^~TqYJp4_#i3)Po@NgdS?;xQuo1f%5;BfBz+l{@Dn0BSb#kPgcwm2AAQlyXaKZh<7jXtM z*XqG~Trh-+&3WlZs@}~D@|1xSP{Bt|_yW&58_QorB zIhr4dMTv)Rz8@J61(|F4cSC-p-zP2ckjrCA50{<%DBD>*h(*!E)gMIaL6F7t5XI}# zovDn@1NBI|v(jG57zjb(CjK{%(%wzl)QlaqA^OK(`{>!Ho z^o}0?R`bDPQTU(GD#U+7j5#|(|ANf5{723QV|~BO2Y1J^q|X)apY=Sl)!_ZMG0Xh7 zst2v}_WN(n$=;NIsAsR2$2I4um5RGO`_&^qHizR~ijxFxz(%~*l_nr%D#KrGx(rYB z?|`qyV^1CxQVzD;qnwC6C8RF^rFyqD(6Z4L*^&JSWe$A)vXad%JK_CA_(|7dIcW8V> zyuKq}-w{uZ`~byZ7Gj5P@&#-J15__gOVW=#rXPuIK9b=#jaTq9uo0|7sewY?NMZP) zBOa9__VE`9ln^+<8;O(!F7W^ySS{>7AFu*0Dq!j*S1eLjEf5>SsTysg6|W9 zd+9g|evNr>?n|e}4Ho@Rp$Dt$24Ye4@b_wZ5M-XvLv6Zlki&kL`vkwxy-zf2{I^l` zzt#9fEQ^2ew>-=}ev!~BcI1ge9WZ(KLv{<#3_DFm6f`9GofZ+X`I#8<-ON6DjqxIeV7 zf3dis{qG-d^74tnPwu?-+w0~}-75SGGH>#a0UC?W5AkLDT2)|kVt8E7^R+jKUsl$6 zv0!keexFgY_EY~o0jv4imdawQUpCAs7z~)xxUAIHVN|i9u7S+8e&M|JY&3GPOkSL? z&5`?;IlfL(I;!);d2xj{bY#DMi$w(>T(FLIK}UkjwL0Sd?a-<1I49hWdA_1R)%%&W zZo{L;zt#MZSd?}==*CbxJ`C=Mzz2fNwfyt^(18A7T~T;`h-Z2V)&5u4mUb$#p?mw| zezCaXiJ8ABMEq>?JeQSPIe70_$3W&<-p%o|w&wYI=PK7JxGYk7Xfn4;7iaY#7DW#? z{@Kt&6KFz^#q)|8YA{L7txaTicdT92yOQWa(iD zu09XMdC_F$|5nd6z0^)Tu%8!+MFk*SaR0#ZK#;lC|EI}|^1^u$^Zy%FZ*5|+!~BcI zE<{}#0L21@MEDnEUgO`mZp?XUiK_Ls_dXsRJ^fqdrDAbJ9A)Af6)jgtl5sicBFxka zGS~87EicWB$V>T>BflPKKK_o?j^?Fe@!cs?My*C(x@RVrmD)fa3n12I z11U%H5H8C?a-fwLrOkI%4`NaDuydB7hlimFK^D_P6!X#?xZfvw;QVBY(!=-TE{&od ztnyN^D0(RWouLPg4}#1SdZ^QU_UPvi+G~(m1Cep$wQ@o z5M-|P|7r5l;)uL-s^b5n@}BoN%fDDu0K$dvFUY*czmb=+{>xRp@A&_U6VCE47H3~T z53&BoDJ0B4uc;GcUgN(sLjTiLtzR#BBWsO~{M3H@5sT9QT(m5*{}E&!{ey_o(4#s`JXxvbPSLH}(rE)!&~<=+kC16uH*F;B^P z;dG^kf42xOaaIpvQS>n6d_xbJSWPL&VtR<;_yEgT3nS*OXDB^%-PtFKdaxQFh(*yu zY70XT93KRkC-hL8#s~UJ1@0fXpZKlvf5%Z*FSQd7?Dx-NQ2_`S(mx0?*ZTi7;{)S* zKJ!0Q)%%?zi}tUz(LdYgUo1-d8`;)qe;khmnaB9YEfkU;arryN|KYt!+n;ijf3diF z@5akM9rM(%=V{q+{b|NXtM{2+S#TU~z@i`DzFRmdTlW1e4-xt9OP z>#w-tCijiwoLK2<=buA};5tdLO?c&td+>VwiZf!TfVP7Gz%Izfk8tUJFt`3|}VGRT$dfVY@UO z1Dag@i5bq^cb1gW{qe=fha~=$zZ)6*D-_$DcU~`3%Q6 zDDp8K?W&E9+TmFe)yHt{C|iHnM*+rdCG)QC)O*p2tR=TyvUl+4Ex9#0<7j2$DxA9m do=h=WCy;ZEiTdb}pGAS^5P1B)GyU&Z{Rhslf5-p; literal 0 HcmV?d00001 diff --git a/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4728.evtx.golden.json b/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4728.evtx.golden.json new file mode 100644 index 00000000000..15df9e67183 --- /dev/null +++ b/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4728.evtx.golden.json @@ -0,0 +1,63 @@ +[ + { + "@timestamp": "2019-10-22T11:33:26.8613751Z", + "event": { + "action": "added-group-account-to", + "code": 4728, + "kind": "event", + "module": "security", + "provider": "Microsoft-Windows-Security-Auditing" + }, + "group": { + "domain": "WLBEAT", + "name": "test_group2" + }, + "log": { + "level": "information" + }, + "message": "A member was added to a security-enabled global group.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-101361758-2486510592-3018839910-500\n\tAccount Name:\t\tAdministrator\n\tAccount Domain:\t\tWLBEAT\n\tLogon ID:\t\t0x4A727\n\nMember:\n\tSecurity ID:\t\tS-1-5-21-101361758-2486510592-3018839910-500\n\tAccount Name:\t\tCN=Administrator,CN=Users,DC=wlbeat,DC=local\n\nGroup:\n\tSecurity ID:\t\tS-1-5-21-101361758-2486510592-3018839910-1112\n\tGroup Name:\t\ttest_group2\n\tGroup Domain:\t\tWLBEAT\n\nAdditional Information:\n\tPrivileges:\t\t-", + "process": { + "name": "null" + }, + "user": { + "domain": "WLBEAT", + "id": "S-1-5-21-101361758-2486510592-3018839910-500", + "name": "Administrator" + }, + "winlog": { + "api": "wineventlog", + "channel": "Security", + "computer_name": "WIN-41OB2LO92CR.wlbeat.local", + "event_data": { + "MemberName": "CN=Administrator,CN=Users,DC=wlbeat,DC=local", + "MemberSid": "S-1-5-21-101361758-2486510592-3018839910-500", + "PrivilegeList": "-", + "SubjectDomainName": "WLBEAT", + "SubjectLogonId": "0x4a727", + "SubjectUserName": "Administrator", + "SubjectUserSid": "S-1-5-21-101361758-2486510592-3018839910-500", + "TargetDomainName": "WLBEAT", + "TargetSid": "S-1-5-21-101361758-2486510592-3018839910-1112", + "TargetUserName": "test_group2" + }, + "event_id": 4728, + "keywords": [ + "Audit Success" + ], + "logon": { + "id": "0x4a727" + }, + "opcode": "Info", + "process": { + "pid": 772, + "thread": { + "id": 1664 + } + }, + "provider_guid": "{54849625-5478-4994-a5ba-3e3b0328c30d}", + "provider_name": "Microsoft-Windows-Security-Auditing", + "record_id": 4657, + "task": "Security Group Management" + } + } +] \ No newline at end of file diff --git a/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4729.evtx b/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4729.evtx new file mode 100644 index 0000000000000000000000000000000000000000..49da30221a502888bf42297ba20b7a2ee3aba32b GIT binary patch literal 69632 zcmeHQ3w#vS^**!NEJ;W<;Ta!*P*DUSJOl)hH-v{FAVErPRU%1BBoCSd2|{U56s%Sr zqC!zbDt}Q>Q9(f{ND+b{C}>25qFA+9RJ35#>hGU^XZD`m*)U+7y3@@3cKI!Lc6N5o zcfa%9bI-kVXEL}TFFn5?mukK|YDWc1jbeyWw3>(f*Pm0)seb*xK1uWhQ3j$6L>Y)O z5M?0BK$L+f15pN|3`7}-G7x1T%D@jYFt{LZ;KZUy7~={?+1SKIBfE(Ic)OlYjymq zYCrE=ihX%C@bty!Z`35oc{OYls&nygA6MHWaBMox`C^Up@G(Ets|wtm>2DlJ*lC{ep}>@u(XlD9v2>-Mb8d53!Ser0^iwWtXn)xQBf zicPK{zg|p?rNMMF>4 zQ}C7et$2)&vS=F4T&7!u!24HM{{pzgqhC&sqfxr`n_(*lN0s2)?s%t*7_Yj|OPK&$ zh%br!e$ss7lpfkP@zM~QqW=v9!){SWe3f0#K-MrCgzwtm?PJODY1+P< zKv&}w*`O>R)z8-i=(UX^)&dc7(C{HcRnc_WsYu7oPD>%pt5sL)1mHk+T(6=y zov1=cfx!jZiYHcUMn4CHOzMCp+8Ih2fCig^vM0)c;35rzD4-kh1NL$nwu?a{E1rEZ z02m}lFHehuyV-41fIL7k(FHidC-FKj!$;Sk&TL)PJCPd2c>N8im6sagP)JjML&@mS z0=0~zCKN{v@GY7Ew)h=K3HovRPW+dSPbrj)w?>sQt+2<_eHxz-ua*^+OG@T*-1Nf5 z6*y^6^$nVP%>dQ`d~o2(K|QAeYKPP6)B&29g73M8eB`g`qWfo$DIc?F*vc3C^oqG; zds0mn0^z#X=ti;93GnvQ$E&W(`0{YGZ?_)#M+uq>9|f=FVUzn=ehs>nB_-i{knVzP z?B__>8zuLyq5I>zc*z!+;#?7`ZeA~Xg=&0G!6DkXJz@qkmV#j%mjj60qV^D$pE|DoqCeu zVbO~wgnkSSrWrM&^H3(LZR2NdeDEP+K_>Nv@^j!N_EF$WCA#Q1Ot)7@hyqHnXAt)F z4vQbMFBC=45AiFu3I4l&Rf3ONcUzQq@WgYcGy+l%k!5rP&~uV81;MKennM?~(F{bY z!N4JERd=Tf?BV=(D5$(!)pFK?LpmEjmjC2h@&8xw z@1;JeeGL4I#q}F9TP?^TT6coWDoywoWM@@cZP@x>@jv0=cD>I>H^PEl1uwL~JCM3d z510mj)zk*3W;}x6R#|{n$@vE>hz1bw*aw1xJ)4(aOcXX&{#)N6q1abz4-U zr%ppm$VQAPf{lr~VD!(dAJ!4;=?_Xr;|C_h-v=-LSRGk!$70b;M~P_1g3PfxGH=Id z*V2xcga3OJ|8w%Q-;W&sJ@s}x5n|(@qQCly#fFrmOMSfhqA|GdhqoYeEdRc3^)oJ0 zX)SMOPM9@j^&2fWo!H}V&bw81$r<$kZtj6z4WHOA+&)s!PUb0Ax=rfxl@KgKva8N%c^dwRc+c3Mo!LM#jP!92E{jBOrU@%#-B zAcrFU1~R0x#ohk+-DJ2nd}MQaywu|%>p=7{U+Lkq1%qtXgIE+jEH>z2HZm|l7S%%p z^}ycOL=PM`7brc99sfWC^{~VwK8QupLy-c`UgSgSpS>nPg=iV{#1^B z`d(G*FOn)_9*9`}nrxCkiN%V4F6li5ikSP=3*$ZmniS+t>ky9xnPd4k=1&kj5%Vqm z;3CEQ^TWM^p0~ie^}I+dHr+=JpU=V7po3giX=MpSFN1eM=2+gHkQdSP)D71e`@#E^ z9wzO)KRt4KFzW}!qUfRT+u?c;WUkOdUFrw*84`&H_bdP3vwm>|{cko-5{u&hyWS1? ze^nxpAajNP>*_d3zu+zLpaT8G14<9y#UC7IB_3GMi^QUt9xBjB2r|d&!8|X*sF!({ zymYbRe|+yvBkkp1EGhuOg8OG~kAlo){L{UU82MkK>b;=k*g|{x7mJ=m@?Q-_j8{mQ z|8;l^GMDk+E-;@h`v0S<^+ikD?y;ADu_*E9wiDs~ksxy!|5)y1)c;b&f6w&3pW4g6 zSX2Olh3H?9xr~3zi5mHTP}O_vgc-ltU}1b_z5f-9LE_a0^UvcmLFR7$A5yhGvA<}h zz5I(sGyc8ke+8L)`R93xWvcr3{^{838zZKFvw0!0DDi*ArJ6oJ@jk9GwFLiy%(483 z&kJE)gmGTzVQKAC+MWBC-~RaP$=2tE%9O=sS5|M|_FJNDL%6Kcu1v<95O^14j^*76 z^Fq8H^5-%Re7^YD-!CS#6PkVW+n!RuvVdf@9Ok0?E?n%BNr zv91jGU zWBqSFFNFTtI4<~;s`tVD!!NLxf3cX3rRhk}g6kE8e?jIl{vm$hpV!?zs`!8R_1JPN z{MRl&I%=|BKrBl9OCA%7e{W-4CdeGizcD}Jb(=rK+xl9{v#%S7^t#Q!OtD{=Q(f?ERe)68(7w)hy&auwF zSbWLbYLE{RWy9wWfAtB_F#kDt3o@7SZ-}Eju6RuG-|(I8+n3F>bDSv_E1umuXW2}w z0Nc!El{Obk_IZ9?kU5rrV;rrk*BkZwVT|LuUNCoUOk9K(ZkNIAw9H*CInej z4-p(^hUtOF8;>hJ9JpC~C31Q&8)u3|(L?s1Lwex&Ajn*yhq^S*EHaKWpHTik^-25P zR{U?he-?{p^1mQ+tpCmPqZ;cERxAE{4mrBVUjD@*9@WvyIL?&*S&+Gme>(h(j5E1h zqxj!{Y)19N7V;zO`WK6$|6!G(_}3EiEP~8s{I?5VfAFN@zv5)`Hp^}0Uo0vB!GiVA z`G_EM8UKd$2Ru%GO4Ymgo6GxI;lFnCEN1t|ibc_XlXpV;XZ{75WBE6Z58QTtEL7vw z@2}={M69Eym5y$0vD;=HiAB-TqC??25@b;w>30MEZ|Cc3-e;{p7eMCgxLm7r6w_$o zgO6J14{8^W%;tT?qUh+z@o*gpGS}$HZS%g9MMs?1J)?B=@d^p+zhx?sAafc2c)pgA|IMn_Pdt$M$aA*xFBTPm zV8Q&)ZbBr;T*g11h-T#f&#K{0lOd@sH{n`QNIlfAQen6W7@qf5f60|GSzJ2{M=QfAo$8!av{V_mZmq*1yHi zj~xGI_f?9;n*1l?-W|SwN02#||M2@NaUY%WzRGQ?+SNnu(&`8Q-bwABw_UsIM`q90 z5sOp$PQEK)F41elxvbJM!1<$i3o^&@ZoHmdSJ%6S-ABjm@h?gbkCpCcRXvkl{WmUU$4*@jvJAaZCJLZ;xV8+T*38LhW%J*8dAK z$MWxl_NYJqU)G=VaPVcNho0?{yjI#{?et)_-dHS(9ttx;df@mh$Xua^9IE|uqQjr< zdiM1p;m6kQIk3gX^~O7t{|7DVU(bsFt;b`rr~m{D>7NCeWBqR)j}6be;q?(aRlU94 zIySMwf9=|z*?K>*DD7|4b)oh*$R9%HSpJRi*lp|m^uK2%>ub2IR608My0+&;PDf_z zw8Wz5s7H24N54WG7i6x{k=xd31=o#oe!ffTXxsA47FKj*y+06(!Hz&}aDTw@NRT;J zN9O$jYAN#+T)v`eJ#NZ?H7ORx%hvf9i!HE{7y%`Coj}G%g3M+7zyHf5;h*#3-HQLc z`=_sMV1fVI^~YxO6=E@I=SMjWFkf-v0GCzTa%lf$jE@AFWBE7s$8~kSf(G_|Ct1cv zT<%eNIPiY+b@u8(EQ%i9s|x914KyLhqI!tn{khcR3SWxofy3gfN)Lw7p%ks>;1D>H1q#vC{vI**8k@D(eSOa zq<`jepW^?I4{f=rp@sh0I{#wvfS(SZ10KNX7-f98D~-v0`J{`TIt1C_OZtUh%oT@j)z#9zKc->0vGUY(W;)Lj?73 z{i+0CP!D{a;7z56OCR3%Mdb8gcAY>hiXQ%y5UvM7<_bNy@j0Hwa=nS;OO?{m+gIE+j97+k-gCL9QA%c1c`}_0UZ@jJa(EZrvj*-)Y zS>7QQMGp-dhV;Pwg&=c<9^9CB1lK3hgl)o%XRY#qN?Ou>^Syg)HZ zA^9G29qn;*qabsvj>6aR7g1;9I{tT6ZD+JBeai~(*7H5F*l_ZrOB&<4c=s7xR%s6= z;cwxf{R%S2^6rFrM}3{CNQ?2yt!LFdPgL{1N8*FnXi=;2>A^dQJwp@+J39W?lN zv-x_&VdekBvu-(R#s9U7!>RatARZc)Iy@C71FwE!(aisR9bAw(*8k?$L8sC*<8`3F zDmp$WxYZK>*5k2Q6#hHS3dQ3Mh{=M?vHUwB9^>gIq478C;)v42A9B(^ZDL_Q#(H}c ziwZ!nkp5YaIaUwm?a{D~pZR}J)w^=bimOs>&6ahX`G$^T}I4SFCS5M++! zKYUz<3w*|L*$1lHrCSbMRcRsaSkD8*;@BORq*h{FRp8Zt1$Qk<)|Ob!o9EdRYHaxE=(VEA-&%>(Z>Je<&Tb8JblbIUSkh z-C|L6G~igcjs%%2bW~^a?(y)y#1+mzjw?O%eDLm!-4^l=>v^|WQ~-hn=Y4nMSqg&8 zv3fAiyHQWc`?&m6)%)HLTgU9Nm4C4)?eXFZ+Xm;wcpNOqT*iMP6$<}6Klz#BzkFIj zpUClVHXke&h5w0d0{l0|n6ne~FUTCrfB1Yb*7wVNa1Sg?`dsn;S+678LcHHOcA57M z^`Ld${@|_Kvo_})>ec&|@hv%OCF3s7{td{B%@KH);v~MCuo0_uqlrkF%J5g4uD}!h zJL0Pe*po|zl#T5)l=;|GLiz$w%EOUq_*{(r9ce1QD?-@?_sVvnuGs2CJ@9`n;h}{1 zrVM8=e)4G5)ia=-Z(!Nezq7@xTZ*A4pa;<8Fx6h|}>{E31c+diEzE-s)%Z34#&zE2G9 zr4uOlHTK~-FP|PaSoA-I9?Y&Ah(*!E-)rbWkhww+b?Lf6Hv3)f6Z}H=KGCcR-$u~? zX5$yJDE=?s6CMu)nJfHXSH~|L4}$X|oX35s^w9YBJ(X7Cf%Wl=SUi&+1es&?U_O2U z|B^p*`A@}v-=@_z^Dh?Ts2*Z|=(+*-&jnadA;{d#|4GGv>vQJCzZx7rN*?{g{h@XJ zi^UCTzkjmXD<_9MU3vYtH_V&5P52jN?&Kc>G!~r~;>+^1slaA_a9q#xwKs`hR@Qr| zU`UmIpHZUrQ~x~yv-#TA%3_;eHqI^>0+`ddtkTwDRI#Cc2$^I3!g=etXyjm-+&EvG zE%z^Te4V6pRPU(^VhSzj$a?!0iwZ!nU>)s(js%%wb;SMKq0`%OcCa1ud_{q(_j4)T zM?{W)v-u&hDD8Og&4G4&7~Btq4+NQG`RDnefdhiNqTu`x&-4_k{jaSp?ObF*_twY# zVsXV&Gk;Nt_}OkFmsMIhc<)p%gv_zL8{=nP&GYrnRjyNTS)}yPY);p%_Ub__iXLwM zb4U-(pb0@1)k6fYhmUHHSS)(rp1)Y>p~c@WkDwmR=7Geb=wWY-_#nt!p@+IO55&{E z`aBTlMU$2P+q}^Hax3w`dR`G4dzA6|8G>iwfth6`4@{_ ziMlodiunqO@Gr>R#((I#G3TWvs@B`z|71wy^lz4zip7yJl!0qhv|J%c#O0t%FjFtc z9Ls-=yfil~FXc;){CcS6gu7SUnwN^j_ohr4y&8Gxo|#-$X@htyfVd;b9Lu{C@=`Ai zqHM`SxGW3EfmU9UGS6N;h(*yu<*bk%9)%_ZSyT@Z%uBQ3evjyZ^OGq`58sc!Jc4>K z%S*+g=%M^~Aw6(>5M-{XUI#7!}8LpivN$xd);p@|6)-A2o}P>Aafi4p}ds!U#{wX_y1R%w3mOeIQt@c zg!MmOAz}V`O`RZf8~>$Y`k$t1{YJ@~nQJWMr`F?-Sd{+fl4arjk05gy|MxHd73*Hs zr`)3We`5cdMNeDc-}=0@SX|rWrPQY|J}7L-WtFxW`frbMnILm4|4tYm(EN`=^OT$y zPFH&PcPsy5d-Wg|MGr$S4Cx^Qt0@IpR1XmxA7B}4Vc5L&45f!|m3pB_5N8bDgePk`UgSgSpT14d=R>x z&-~9+^?vur!u@M4^v~A$7mL#VMzs&MKaR(O%w_!J77EFaxcr^s|M1>~9naXxzgS$o zcheQ0j(ukM^7%Qx_-f9|pRxWw#9NTLjDPTLOuK{;>W9nPd4kjt_WU zU<Cd9Vr+oePF1`tjZ}H+=!wN8ImW@xj*t!AtAWfxi_|zFU zlIi#3(=>d8=bM6Dv)jq6+alZ{#kZh^aAp9<6zt)f*z{Kpd6JCl0&i71dh^`OcdY2h zdOs!>&!i(k=2#t>=MnKVSmG#Of4xod|6rf1Ka3pzX4hZEV$FVR6>^A{nCBN{j^#i6 z`YW!u$$g_do}R6EU%ma-#tU;IwXWLi{vWZpenV!f1vx}3c5+#zjRWV2cz&iJb1d)1 z_*qxi1@axDVb@=8S9*A8(?zNF>Om}u9uB?|(!)^PewojS2<=buA};5udY`x|*Jl33Vvu;X!TfVP7G!SYzfk8tR`XMT3|}VGH5l69VY@T} z1DYKDi5d3Xcb1UUAR64tl?LPZf|7Z9ZE5Eer~gNW88k%Y2jp(K&8lm ziy~6_i-L*@ib6q(EP|k*5f!Rp)nZ++1*@(8n*Vp^-ScK%7%)zK)6D$d_(28+6^t7&zGxEq_@U3~(h5F|L4l1)M12=tm%~5* zn-AMLI;{I)^F5jdh`z5wbRwSUnBRPasAU3CFAPKc*w6kSxaKj~1w>q_HsS}9GY%cukXmC#u1$;Ual*lv$> z0`^RyV*DzmaX7O*eivhZ2bzjwMMyhSNBrx8t&Y?k|L2Fzmqh&XX;oDxQC3oJ#iIh0 zP1A7aQr#j1-mj|a8sL%={rijr8mU{q8Mg9p))XA=hHr+5@$!58lm)PbI7k!>k`@@F z^w7GIp9WKzekBg2QfgekI2w-ArmHi)&aGo2YbXuGu~zs7SaN)u*6$|K6}Uw%D4T%n zPtYMSbwNJ`e8D&h__ez9GwcwhpOsjLMyt~%fT~#l*CwW!$sl{R{obfO9&1qK(Y zE53NG30(~cS=0_yv=fxl9~CweX%D0Wz(soqqJVC~1zgJQv0V%rS@B#J{eeN8^osTg zC~hvcG9V98OmrU32#CKPml>d|kY~28@|{c#;{3sS)WT2oaVn&#f1zYFXrWvtP$Np9 zdN_(IfGz$eP?CP0z7zjt;8z-@;;Yf8z82Wy>o%Qlh)?s1{|pQ0e$$U4uE0%ut0SoH z)g4$n@WGBN5BZ!5sO?V4Q#)v)497W#eC99df_vwTDj&6E=&Bcc_l&z}drEZ{LhgF> zx90`e(X-3u?YVDuzF~gZ_}$w|hfGYvK0XVj=Eo+tv-}x&3rkAe^+3G{aIVkGApS0_eXosH}A$d}@y27LY{>ih_t+2HghnyBl?Kq^6iExLEN0*K*)J^QkKs*ET`yB zAmoY)kY_HROt8d_oiC*hEV9Va)IrY4_%@*i`d5B)mGEIdS7g5CM%;m$;WAY3&Javz zs5ldKc@VTZis0+{6W<8`-LN_-KrOp28F%RTvt!^GPIv62Mz}T)rOss@LN-O07&~S2 z-CI41+u+j<-(GYT$16CagxW%q1F*;JKV+ZbMb2b@ltu0?sd4VE`N?xf6{}0WS(+HC zs>xc9X=xj{GF$mA>_!2G{8k#atNSf3Q2z8sA+p~Zf;634piqaV4@(F4p-*47xFoMK zyh9F*sf+d%)%OnBaV8#X;^l^-q&Z6Bl4D)w>zy%(>{S~~xdeS=4B z&8x{BM=4Kw6>38VJqF>svy%$7(Awdr*(sw@k3HA~jj>b2$EBrQC?te=2pwuTF?c zI^&FT1X}snHx1;nFR9*Luy2d1wbbq5@p9n-i(q5CE*Skc>xXs3ditHxQO#b2D472y9a#sAz1xgSK2{~mfh9uKjxQ_(+t#bSL* z(WRcF4m1S!eeo4!uH`?lt#0NeDy-%0tg*94t$CyQrsI2qO?kJ9E;*v^&(%HDX5$x^ z3)c@0K^G`ix=!l+wVm>*nV(%{;b+C7)Q>eOBXmF85rCHfs~~f2`I!CeWC)Y}?5XWS z`%`>cHhfvA4d%Y(WNdTaipOub133i#Hx&P!$?x{Vb(2xFkv*GJ{iW^?SqGwrg-Q=! zEE?#r9>k*PVW~+Ea}a?EvX~yCs0S{6P4vKSbCJ@+=$!kasE7M4{DW8&Jro5a{evL$ zgdXyKgntN)esRaY2;VcuUyT>is8p&ggI#7~P=`9HJut8eYJ5BB3Hv3RcD@kKPJ zkZ}8ujP^m0xwibR<0q|eIDRTeJAJpx^;apo;_i!D{F-VJKZ(VPf85`z42qcd_48xC z0Gc$!PV3>11(|F4H^)y9JQ4FP?cfr{`*Xwm1D~_OyZyLGEH>Ux^`FZlT6&1nO06`B z=wk_hv*-4_57vlK0+e? z;9gb!cWqc2#qzi6Cy7NV|2y6_%71k-ks$L#`PbHdlK#M3{6PiUiTjiuzDqnb)Q&%} z9~X&5D?L=8jSyt6)q{0hgkCT6E^+Bn#eYt(O(UG;Uo0vB;e^{~u8)GuWBk+I51aYF zU*&tzlw*sX_@wb4fZ%zpbT z7Q@7=4d$QwXM)Vz{6DC2ef&VtENA%_i&p&m(f$fD@AA*%6w6ii@BYKF*I$U5{;kG^ z#G?5Bl^1LJ_{0Zz#?&1A3o_U8A2}|Bc@gGup@*clm$f)P5zpKF z8NT-CQl5F^^0wmxs?H)VjZ@+yOi>E7pLFU@>w~mjh%|BS9`0p|J=w4^} z7mGcy#M|7@l=fMWd5nKL^0f3bIbEyxKX7bj)k8MoBm4Rni=zLbyA1!=9OEp4%wznw ziJX7%gyO&AMAKF)9OYjuDgfbx_0RE$AoCdiruhflPkvJ6yZGBn``Y2ZX5%bY>tn^D z=)ciBhW?p`_@%9bYwrS6N~lm77qwoUp~uVIIh^(&_L!|9a;Bl@O}<+T>XsVe^38a z_c+VHSX2N`;a`w>jDL*tnfZTKWxwNl=X~ib|6)=2msH|vLFO_3QQOV@uUFX~KH|Lk zk2>mq#G>#nsr2gwnYa1hpt8Me^|DW$#nsqinzJjOrXXK3dCMV0Md z!8w!GI?BITOacNc|1Zcq#y|3E=6{pozqIj)9nUz*zgTRH_v~{2H%B31{Wni15@a6Z zAMe*P^S@c;`tkd+9)8wQ{>7pK5Kfr?IgN+}naB9Y8_~@C|54?8dFS=}o#kIFhKW}j z!oMK%82?)R1!n%Ys9cx-^X_k)q|v5wBXu5z2o zcGciJw7TKHck)xe@7e18I%2V`&*VFj<`KO%jMGXj6P!PSuOM?R@8;*(wROI0#5y{z zkAG5nc(i19oE<&be-0!T2l;3)mNbW-Y_cB4;48>ns|V}nK&Ew6JnwkB;(zXu&usBu zv*)>1^-(NJeY|+2Q6I-({=Xn|E&pz)kNW%nW&SyL2VYit=+P#{Z>K)iOb=G`jm4tq zp)k|X1N&z|<_SIIQO(~I9rBwrHmRJ-Wbf+XMDTg3Pr#vThHMOBtu&^c9usF=hSNrrGE(+vi^_Hp5I}IF#^n z0_h(KGLP~9!7oyTe~ydyDE{{yn6a*&4gPD^9$WQ~#A3?MkMrtbyyEylPAjz)(EiKl z9|@9JSB@bb5o9qv zL@_>PJq$4G;h@sP!Wk7ntAiZ7k@ z4`NaD@Nt5nhjnPP1zAiFQPjf?tCIp@J@9jaHOm}u9*(9Odf{A=ci)A9E}d^9wDSUOCGK7GZa zRr&LCa6#tU^0$5tI+doGp9B3_(eYuyEw=c#?~lcz@ZWK^;g2`MCkryy^6v(JjJKN@ z{cqOAdrA+#%ggw@k&W>f`}I*QDgfa`+Gj!LT0L0TN7Foh=Kp<_?_FC~UY_nK|6(yr zyxL&?xjqUqkMWNfT>K%YAE;apZuQv)XZaV4R{XCA|ANe8{1+MTx8i=nQI-A14R8M{ zdi-1U%fw=J{x_p<&>iuBAagDMk^M3};4}BjK2+H**>dpmT{irV{Ww4@j^1%m`Y!a# zrtIgmQtOMp@b~B;2r}35?uIy^5buzlV(ypyMd{(0@3v({PY+i8GO;Ln=<-^m9t4>u z^iV7NWvqjbRQYfH_n)Fz{#NT3#G;h{lLw6Q&r39rd7}Jl>vK5@pua5sfa9W%l^*t8 zd2*y3e_+2~AQlyXaKi1wS8)b1*XqH#UoeD<&2i}`D&Nfu@~?E3f3bK!(ftrY_`RRP zzaaA%|E1JU_~&}?SH=IhIh(H7?Pz=?7R4XF^FA*aWb9xgli zNw%|k5R0ORYd?zAgCL9PA&SqXJ5wo@iyrv7^ruP>@0P3|9X&l*J(m`XqK6G1N9sY4 zc|s4KelE>=`kT^Gt0CFN(bJJt+$|PGNBxgQ>PV1zLPxbW?#@B^i(ldR<1?j)9uM4^ zxyMG_VL$E`iwZzE;kfTkyh}llxmFL>aX0cQaUZ9jt9;-6QOmf!j`A-Sr9NJGe(UhK z825t(naB7qq(b4J$0xr~{FhHF=p8-&t;U1JqVPYyRfzwF=yP_2{soz9`HvhA#{7O6 z5AKd>Nna}7zv%hiHiP&1qnG<{S1(%U?GN9&Eqn90!##VwlGB{MRw`C`_NzyJY!1h_ z1UCsx#74ZVmC~)E)ol6JAP)Bc-^5`Ik?ts+tMyd<)CIepOZH0>(KgwfaaidSN3N zBrPz8H&Q7zu3sGC_2o1jzfr9yu#6A*Dc}pnQNXX&B{)3VkDb0?UGn>JW8U$Nz60*n zule*HO~9Hj=;KQ?eMcXChsI~b>pRBjJL0L4AD|e_BJ9vjzKD%rfa=9*N&1<`^fR%| zXEOYz@d|zhHiC61HBiVKDGWb!#$$5Eem;;u34s&5kw^(~TAF^-rU3?+Mw(x%s_KuM zX7G-9tqEOCLn({ef!aQ`o#s5tc_)V!Ry3OymTB1e?~tv_vKUl28;fu(1X=;1Ft8HxZ2#LQn!Ivi@Kd{P_}7gKrfw7d1(`SbM+c2X z=ZE;ReXT06IU(Gy=keN!QZB3Nyi_o_QeS73to_t~Prz!twxzPz>K6@j3kCz`G)^nE z_2^Y>tZN{1ZMksVdNwLKSSBxy*XGLlW%jR=l#c2=d0t$h4ISC9-(pb#2q&zg-O!OB zbFGfJeLH+=JqE&tQRrNt3(=~Tu4C*?iwb(Vjzr~rf$;a`w> zjejF9W&M|{eBb$>iWAQAFBa!qKo7J2a}*NhpXbyGGOzJp5~2TTD%WpJc{6LRjri2Q z{}GGQ{#>*?vi%Wc9^?Ps71y!uWq!(Z#sA|6)-HL<2LJZQt;OQHMlYp5iT*)hb51L@ z&Cq{a^veX9Yx#FW|9}>LY>ZQKTsTAN;omKSOP$q&SQI@BIp5GjCT3F#vX~yC*gwED z*20K!>zPUqU3c|~q8_aJ2Vzn5klMn~1N#R-<_SI2rv8CGQ-RwDZYO@N%D>~4*DkZ; z5A3(kVo?DIC(=F$GS`;>Y5E7o^L*ximdf|L?=3#C&PMxepMS9^^>1WbqyDi!7Gxgd zA4@1CKH~H@ivJ_~l6E}pDF0${&Av^SeLni>VJjBqUGw$aRX=0>e}u0f^BDi&+suE3 z;{Pe_Z!bLSDF0%y0ak4wFben2gnvQiUH*Aq*KEaq)tuH_?C@W+{=uK|K2ksRPVa4c zAE{Ur|FdJd;eS~Fg3Pu2oBIbmFR&TDp`~4T2PL+68Q27bWBR+O@N0s;yo(os@e(gy z8diWovt0bj$JUKlgEW=8;#VguB-7X9(=;5x`%OWv)p9cXwg@YvcnO+;GZQ$7P9ErI_ah-lBB$=Gj^A*wK;wc1$duPDg^wwK}qnBNAzl_)&iTdaL69f!h0KS#1PFf&M(MZ%YWqaS3Gf(b)(#$o}+kQv;CHai}Rv2ui9$;k67HWF{{O* zJff95Ijz*jfb(R$KU0vomUpxNtgZ6`d4*`i^Vi#y9v<9uLAtYg5R0ORL$4Tm7=raD zf-I(oXpXOxph-4Af4yDl;U=u6kDeZ^##h9m=wa|KLl5j91equFP;19m=Bo0)uvy+Y zcFNy=TqG71fN;X?!`q0j1(|Eh-#RWr{gb$e(|Ic2$1l%!n18VtCSGkY|Ll(inb-I) z)cKFsg47S)m&tS$x;A*(E)7SACQpB3hBNEVl2W=qu>|pu_`mY^BmLieDHy!1f)?fBffPUMQdDnL8y?ABT w()pL{8$4=jUQO;eO4+yy_wIl3hPRyPWNRKIhys z?R1R{bq|jW+TxUoAI#|-SlX;ESX|^E-`6cIeejPPp#cOCKmY**5I_I{1Q0*~0R#{@ zp+MKjP{+=(JN1A3C>`%S=h^yE;L<9y7kkd=i%S3fPw(g0nqjq8PAhU|KUbI?&6<6g zDL?nCro7q3`WfP{ro$(wb3lE1TA@BY{TP=&6hHT8PwCmvqIfRR{ZH|aB+C}{F&ek! zbq~bXSE_8c+B~?Z9WV2Lq%)Eqbmnz-MAqxqYfdZuH=Zc1y>Czc(8EW9+90s%;F0T} z$s{%X`ty(W_P#arS=+_$Zf|@|Bk@x0_4d3jeSn@0R%flt?y*4|vnky_q$9U0&U~vj zYrAdKMwB_JjBLP;iSl5uT%WXQWsjOP7O}D4* zN)@{=F7ZQu#XPL7)~UQTI&!|`yqR^M7VH`|(J!)L4SzTc!Rd+_%cY8G%VmNpJ53Lg zmAt=bpPP=9^))&sj zoneubcNkcsZu}MS^vcSdU8M>1X>lU&F7TGJ)})){&Dr&S-mXygjOJ}zjstS{qFHOm zi2Z8a?2B7$d%Q}W4u_^4DmthDe2NBCCgkzA$k)`S*}{SuOe%>dXZ7izpw&{|OS;oF z^R%y3gC4R+63M5E1uJ+gdsQjf5T5(4$~wYg9>+)+Ny2)w%5`_gZ+PL`g0-u~DFyDU zWlAHB+AUUCZO%6ZpZ3;w>dm{3TJkX+r&5hCmr`j|eI%R6n{QNV0K3D$r^Ak->D}US zXg1AbDSTWRuh|_cIH|ulioE4>zP0+)?%kM|@Xpva0Vq~lJ{{DB%gHxmPY-H|cBo{( z7SdQ4w@+G~1(~2!3ISBmC$4QQA3}|4DR^+vyOPQV%k2h*u+5tFif+(KxlAu?kIox) z?vO=`7Q~3%t_nWOExH~Tqpx_Mi^~*4vPnPNlGk+mv`s7Wh}i5@mB=Og^-xdFuG5&k z_jugZwj`Y?*4wI#our~#n&F|9tS_`^lzD5gywxjLuYj)n$Xg*S7e3TSx9;k!R!3lW zr&sAo>ik)6P^ocl+p909ec#Mzis#hmCsAYC7ZvBi4XjxnzHtp`ocAi!=HHB|S!-fi z`94A~d55ija!=pxzWrNYIJmhjz4q;z#R}1OUHNp=5#Q83`E~2j$8PERV&D3iO{aW# zzg`zFrCGa6m;OELsq+C}QptAR8BRgJp8HPNrL%wU`pSBAJfq#oC&+VG>&W>Im<@{I z_AsFs2bG!7Cp%)QM&Le;7sPF?E7z=BP_t7SzUljT%e57+*Y;W-$tmU9l?!V3s@{O5 zYErhu%by#UUl3=nOmDYc;rb~@n$%23HCyAF;WiVEuvYW)do{~ZYC(Cg8{@iXmZPj+ zRQLBsnT_iIiKu&|bcc>HEp8ugF4{ad#66#0?ztx11fs2IL}T{(>5-Cu*`;bK{;)^? zHuGJ{x5sJqH8pQW@=;A6qtD2Sa*w_h`z&mUd-1JxMtxPPMn*4_*~xl!s&y>4CE>9w zzW3KJrEAakvu_?A=WUAGzxt=OrEJh!)1$qkOOf@NzFRzH8}xDOONE>@weBDK`0Lki z&_;B;yzc{3-2siw*H|Pm5iV(ubbjk=UQ{zm&BuwPIm`|J-4tE%i2wo!An zu?G9bHXr&*|6WPX+pXq3zfaEAxGKE25BwX6ga85vAbU zeD^!wJ@?!@cP4`h3o<4Y=2Oj=NA0LYsZk73idOTG|N3*vS=Dd+*C&adAj&|LfhYq} z2BHi^8Hh3vWgyBxlz}J%Q3j$6L>c%|1_l)t3>aTL31j@g>vUx$e~n3j`SpnkQ_sIP zaJ2RR+0LlP@91niLo*-I5A}#n#1b9z8owcG6-U$y(-1%Pwf9GU^Ehnss~K$a>l=0a zYid95TY`NBHSqMo=Wo>{$vHJ_6sdFZZy#6N!*Of|&iPV}^YAf0*Q*NLo$hs^Oz6}& zplw_DG@j>p0bE~vuO`}BZ_AyJn@=MW=^OgXYV^K6$k2 z>XY!5_^o8LkFseR&Rnirguwe%SN{^Y#G_wLkE4;g^&4R;4@Z^a+irMgh#0T9*GpLd zTZAu({C?7WW0fA-H1^V9nxg*_UnNs=OurZ!j>B$JM|_=I&p_5t8i?;&m0;)ejhrrbNz2x)wW60;#>eDZ1KBN1 z5u4NaOtI7oAEf0>d_9h?z}M5@w-WG}2j2P6SZeGA?IZDFfjVQ)yX(W~1fA0XI5Zys z*hP6bMyH2c5o_x5=?P&Tlplc}AEm}<2~bNYmSn^v8Q30$6Eb8*5@6orPoM(c=JFvd}+BN1AEjpH&hR0~h|DuMdpjO75%YAHue1LyVEqhuck1$KMaZK=ej z183qoo#sbLESKu)BG`~1vVL7WDo~*VpQ0NIxOWKSfH#S;BpirWnjMD&%kWR3h@&_k zhgNp&tv%wv@OZ_o5a5rexEL)(mlFqLe%%6z4#1JQ5K^&@o1K0CfW%~>5m4RiLwXE0pKDXf+(aL@B{X8I<`wdBP*VL z(H|HjNH0r|gS**nQ-C}`G0}NA!YA>%Ak#-zq0Vew)jN?I#(4dy)Y3~0a44jyzoBGw zXn|VBQDcguRD6pjfGvK`ay=DMw4?Z|><)NNa0k!=pb!rbyOu_eDLq761bisYIM^}tqG<3yFy?e%7 zv^A+F3xROmb5z4v=>&ND=})V!&HU<6)9*GP{zoaA3m*lq6=0M5S$++?nI$FRdZ6xt zT>&QO8QwmQfU#&|!$EeD?!VGtB=jVKXm(#4b&hjGzlaa} zMK)@fN1h~&8uIa%sN*jP9q-ozP$^i*hk0?X#9U93Ct&GP^-H#>u%(3kav=ETZiN{Q z{W|6hI63f%UBT%+1I}!C?FO2tD>Q^uei7*>5AF`aJhnYaID@2{yKbc^cyHih6 zJS=+AgwT(n!8E0Y)C6Us+UC#asL$N^;6ucMEb0a2=fO+tqrjO;b$TB&rC$A zLBKMaPWS7p5%Ny=9iRF1^)Q~j^=oi)>D+5N^=`_Ib6#!EI9f&0tDw~mdJe*8 z=O7j6p}7x9)GF@ETi6hl;Tn3W9%Xx4R}xisqe|@I{C5bbyi3(`)`EjN8$Xr*$6%e$Rk>NoXaXr_!nenR9kJ>`d{%s?%}q*&P6xEf?WwOG{-xT zx=Rn34u93u2B&5`g5XwJh*rt@2P@@z^!`(+D?W8XR?-N=G>Z65{WL7k{dbthZyaXr`k?v|~Z$SRI+S zW3+2&$IHO~-HQJ?6LOD4j{hEdJ01_QaZu4;eZ^t}O46mCqrPYa?)%~`$Q;YRZ%h5m zOH^9R+gamgjb8O;iw(zj`gAoEk6nc*r^sJ}kcj?4kU7@>=J}J>H<&+F zpr5`+)%we%9WnPuEPqWl$)Chx8`}GTBKL?r=Mj-da|#z|sP{D0?r zA^)#TBobt<@PAz$C+QcwB_33wpSWM?;rsXlL#@OE>v@q_G}A*R`UpYhSUs5MMHuxm z?~<1;R{ZDm+AzXi{>7pK5G=TV=JqJaT*g1$^N5lE2UNWmlpb4XFaKiElSuw6p@F*`ohHs#;&Lq|I)7`4@{4e{MM*-X94vm+_C~PDcGNQT+GF=<}Jq z{EI~eAXte01)0nE$DF8<{|8mQ$Bdit+w~U4XV&{)u^1#?Z7}~lJ`-f_=Kmp8>*M>1 zXWGlZSTy6`i~d)TxtD*Qr&y}0f6t$ez42ni^lvsVBo-z9FTYsR=O>Qf8dD4KFUTCr zfB3u*)mjd}aUhq=lpY!!|NdNi^&l2S4;zPt^e`E7w1OXb1VM0o|lS61t3^(|G@D; zkU7@>=JP`6pN->!KdE{j*f;Dvd-)fO8CaT*1TDB;LHHMBF5@5K7yfzO-J^>C_uh!D zu)=@s@}r|B>jlK3#J}Xxq4@U>#$|%cvHTnJBVM=p3%sqbr9AVxfk?004BW(3jc{*g>jB` z{>9?U-j)M>h$!p7c=+p2fQI?c!&{KKjDJHM<#EMhivI@hcH6pirk&$Vu~_-+o;gcr zVg=YnE~~V;ShCOa>w?U&{2SwFUA^9@-w$IPXRcIwIC|OYo%ZTMEQ%hsZw~399W)`x zqI!tnI5SKSJl=R*>0$qk+N+V%gV{J!EQ%g-{~Xc-#|J^?3O&@Nab~e`ocV;1D>Je~gqnPdHLo*&g%f3QmN-(&F6-S+Y?7JK3rZ{s*q`e#ArGXCk%GcwNP za<$@r-?16h4_nBOtm|JaivEZ02*tk^m}e1WF5|y#`1*q<75|kdnzdeLEB|6q0SFeX zf6hk)nalV$tUus!@>8nbCEs4!*9!l&n`be*KUOS?{u{p=(m(Sr$Q;YRaeUym`(vRR zuYP|uuOng|J*{+fbMsv`>qsn$jussZ*O4HL>PWvE@P9jBSMxq={kZ@#U&rMdrK6aJ z3m<&cLVr-Zcw{#3D;7mZhd&M1ksx!8j@&lyJ6UwZdEGNgM^BD>=av-~bYwlR6N{;M ziU$O(-#*J=IImdWD1^+hIx-*E;Q1WJy!u(i|E~Tk?zNYHv8Vu?!oMJM8UJ|hjgkN7 zRP{R^KIaR2`4@}Azm$?!3o@7SkJfJFf32$a@Db-Vc+A%LBNl~sDP>$Q$lT5UI#ul@ zE0=s?FaKguc$bp-pMm%<$lT5U^QzkW`abP>+*bVuEfOA81{668iNqg4<}&_~*Bj%{ z3#!%~`|ZlKmw&OS00h^si2enc%lOB0AC3I4SJl6F`}$4x@-G&Je#USx&L--eDF5_QoFwe;UCROW-f8Fzq zz5I*C)A29JT*g1DYvg~ks{Vz8dW~OeYy1(5X8iALLL|ss#{bdV76|`*pWn->`kVh2 zKRuX=`;Dxgt&nGscP@tX~Hb zi-SBg7`HSBuWYg&#^No=9IFTO>p+J4sCeD+R>l9EL!VmW-+Fr#i_#u19vNznW3m2U zkU5rrC$vZX`Tw&1oQH$2C_VIOo8-099&4uuv-QSeQS?xh8PWsCXF=u)J>*gCpA#Ma zY}Yfd4+%fEcF%z=F|Ie>ru;u}QNMat{BJ!Ti$w(>SV;dY$Q;|D@s@7wt^k1D~VZ3aef3escD~SK`e?M-mePjVKp=%$fA0P;QhJO{W4#Q=z+uHYf2A``wfqv9?Zte zVo~&P$D1KNaC{JCuFykW8ZS3Aj+gf+|KGW7&I?xJf%X1bESmX$Ba|t~9P5Ac{Ak$b zS<*jqxmWT3$A>meY+#{(w$8s;-0!DDX8}n^g@pTOj>m$`W&CU5>sVe_wVwI2p1t|Rr&jp4o}Y?Ei9hqc3-5mfnPd5PLVj9? z=agnkKEmZbrH4hg&-mP4J%~lo!+F}r!STv5Xr>utoMm_9TdYC_bnaz3- zi=v0=G2wa;WKlgtP!I4v{t7wbg8Y4>HLG%9 zxNc>FFQ^B;PVkn}!^IEp{W5ZTFuP757DW$#N(k43AajKt-1r>N61m>Q@uf=XXmY~I zc8x5I1FYwvVo`Lo-yhNukHZ9+D|A#>=Slf*RhJn1nYWc59$UJ-y}f!6i=v04$ss-P zxKNNq^$@{+<`g{~PrLtQ>Om}u9uB62>p_r3^$yACIhd&V$sb1d>venIoAK?*FmS!G~;!k zzbZODD7@Jc|JLKNSQP#{&I-lj^@z!W%(47CAs*xDCZX{+>*BD|!yoc8K5J}YKE`@` z6pIQ#u#o;)kU3Tl=Izn2j-UB|U)6iZrsY?p*~-6I3=*$4n161Mg3M+7BL|mw$mJ1L z>%px*U1u-Wx}EAhbkxIio_0KtO$hc9D7 z$Q-K&^KrotDlz7zAFFz|D9j&aFaKik0ip*Wgy3^Og?~ZjGXBe{z3|WN;O~n6g4r9c z+-YlmBo-wezWqUXJQQS(<=+YUk$#`F#6vERDLq_v^5blK^&l2S57&Gct_MLD)k6fY zOLwMnst`T!b?Hx(9^NZkJ0@~^FuN`-7DW&1J_^@^AajKtTzy@d_4E&=qt-*ROCqNu zv%Fg@ijMjp3)hh#bA^uTY~Gy%|4Urq{Nq!lhaL~!mAT78-eEoO7K;i%u;9G!E<8&? zkU3Tl=6N^jDS024pQ(D^^I@x)-L~>C7NtF2cz&DUycmyz1)0nEFQOvhpXVn(SNvB@ zE9@OP{>|ot#iH;(zIA~AMi_H;g#HDYWBCuC561d_nGf!cWl3Ks-aqeocuR=)+s7>R z-liV3&f6cneQWl{f`dJKy_(a4qgFER^6ZyNUThA>y9_7sO~gj5)|JL1Wh%#CZMqCk z^zVSL#$iuB6;Up>(@{>qo>I~mfKmaDOvmRE?C(HR@m(>>&bU{$BXz-6N9vCM^9c_n z#5d(QgYlC`tFE2_?R*Q%o_^KU=K{t#@LB_u8NIOK_mk!u%Nxm*9Mdm`@c44N37^rd z$hU;Q@RHBtk0GB|t4|1cv==)){`%zg;>5h;8+`}Dt5@^rJDP$ukKe;T(exdC^c@-> z5v%Vg(09aAV=q84m<8COn|uiyejlaAXbJj}$Mhqy%||l)X0Zx>1~&ZlDA`xU8%Yd5 zaKz(s#9sa)j^cbLcq5+TVzd;E1VINH>7$T-_~&aLYJs7n0Ot9!{j!<5_I@6RBa0*Plu)y*lF{fcOn& z)SIyKtufxIltR|88;CM{y%?Xh8`ll`?BudaTNFn$9{h=d9os&gFfJ~nL~R_$3%*Yb z?xo`>_%-I?Ij@`=H(2yPhaSwX8;C{G!{2M@L6EsZ4|VCfK`#4U?i2h{_de0AaocM>c z0{$g`=JKD4|2|EsZRTGr#!)@Q{Lpm+?w<>>o8mFOKfU9+@2;OWb&K#X$lS?4252lgFT|JaXv(d=GGP!ZS zHdpRn=J+~E>8RdQ=fxCR(2@1_Efy7kV8J@t2^|SC$Lfgtw}Yp)_XI~AyCX$NQ8eu<~IIA*Nr(ZEmgJNdgPPAk<-6fUMdzx#84)#QPDDmBoUW`F2YQ` zAagALHS*H@u)LHnIr8hF7US+(Wouq47T=#TWz;Ij(ZAagA5PRL8W zG>~#758<*rAO~7;QOZ1f^&l2S4?AXs^zbM&A;_Y7h+tlt3-^0O51gM&QF{0x=h6u3 z!7MKoi=u~$--q9EF7W=QVYL%x(Oah3S8qs`Zd_eO*3e8h; zUN~Lp;omL&i|y5eSQI@BIX|R_Osu99WKlgtaD0GetVLn-)-#kIy6)%`K|Pp_55%JA zA-QEp4;&u^nJe^Am&OPBN(Js8xS#l)@_)xs*DSFT53KjkVo?DI7ScZmGROM=G~w(lPy6RQNPOzrBlZ0^?h}_|~vOOq%85Q$Dt?$2~|>sVhEp z!i{A5{rEHu-{ASCAlK}6GV8VocS!LqXd#@Lz%d1T_$D^}l}DZ=LA6tnWq6Oyp1({>{ z55NA3D{gY%D37OSE8bUay}8lCyhyF9HoN~vEUsIh)p9`|(emwFR%v6wc_N;lDaahl zyD@&&)pdbv?;yVx zWRCT}d0vF}CwUQ=OkAJs|WAL;Je#JJ%fBN73Y}Iv9!GYt?orHXb zV;mIzn2z=}#zyV&EQy+9xb~E-KkTCr^(cPVZb=;PBZh{<+t3~+1WYY z{mysKJ@?L?$-sjAj0pvKRQ=^sJ1S6W6i1Y%RX^lE{+xD3)$9N9Nn$66F%V-Q#z2gL z7y~f|VhqF>h%pdjAjUw9ffxfZ27Z!(fd%>f#}`e)7(etnRawDbV^Uy#U848sk`bY! z?f=hqZd-l$6Z09G28e#FLv%cz=&0ZP4N=PkqMn$B__?pWKk=K#V3S`>VUu6qs^ec( z`+46I?8~o)r#C)-rzT0xs%E25or{0_nA#qOV>58h7pt9zkNI!CD#6{UUgyh%PPGHt zw1H0(d5$Oax_8d%aj(v;)KWE#lC|4MFZIhWdHch+Zq449f3Qc-SH?D9gPQPBee2O9 z*yIZG>&4`F8b~)#9u-j;KF`5BFj0NEF*TmbsgMfrWhuUh*SgSn99Bk?=~C)|f2A}I zd-8Bh4z}B)oPa$gRE$r>l#e6Z<8v|gcc7{Gt_bBt)DizWW2+-|!~c0<^Q94=d|Fl2 z3HVCuL|^oh!65n6MSf*bUJXlpGN7vn4}-#V}lws#|Lf#{CcukfQG|?>=veo z&1rn5cxs6c(sCxgmOz)|>uK;?F?h@c?|f)HHS&XYjwlP%8GGDS7e*)Ooc70|c>usJ z%Ed7{J=}^|Qwx}lJJ2Qvrs@T z6IBQ)Ft|`#@x^OR=qfgyjC;rR8r!-2%TcfRUEwIPe^(Ha)sgGQU352>z<4yVVIaFu_g_gk68cg=G`p|0I>*_@FA^hu zk&PPWk}pN027LU*>iF}FW zAQkGNxerO!%J0lw*Z`H`8v3aYW&2uH5LI=h3hd$hcQB~DQ`K_Tf`d96KbQa18u9-g z`1ez<^j;?Z#p1g4SuGai60JSPWu+$k3$oLyttM>!ulOJLP@A4-qZ?ttu7nqw;T=ld zr3Y*ee^u88r)E5Y;8t0HR>}DXE9E-${!^(7K6OG?auJRwN1~O7ebYcLM~>>l1^c$B zT2I{`aUlmWq6jv|>w?igvwm1dtfxOH9gXdulz0!k_;Yn+za5K3D;*`H9Sbto>d3ks zqg_ioUIzZ}QvA=Ekn=(G`0uW_%*PtD@& z3X3=^7NvcxN*S)l*^U6b2v`M~YyD%6vy&lAjlqKCyMJ}kc|F8kh#|X*7=jxC!9Z( zqo2N8)%vTH9dY+XEq_h5$e+Yw#Xs)vIR%QC`_1!Xz5tpu*iRfkUF34QVyBqQ%nx4M?8goB* zkJ7`W?e}IxPY+i8pjZ?=^nN>14}#1SdZU@I&H(A$H<{{k%vlTIrzzeS{!$tsboNB8+;O zcgaf^EB?p!+%Vi({>7pK5H7fX=JqJaJjOrW{jiz;`&GRclpI~?EdOHBmrTJcpop;w z3G=@eZ$aiU{@aA+vqk@ZRJA^DN$cIt@-G%8{@ijbvOf}J9^)U&oy_`QqWJHg(fe~} z`4@`{K)4Y73o?)Kk2z5@{|~5oj~+MUx9e?;&+PZVVlhm-+F<^9d?v`e&Hsa{*2nf0 z&2*N3v1rA=AN{W&^Dh59Pq9>0|L#8>ef@=~>ECKzNGwYHUw)yc&rf`SYfR0-zaVoh z|B>@TSQlZQ7kWrq`;<0k{^h2he?8g$yil34*yOURty^v)+A@gCO6{^#%n5;aLFQWC z-7qi2>mjd_aUhq=lpg9I`{8V7^&l2S4;zOXdYFtkT0s`mLlm!?)auyS78 zCehP_)jXkC6g?CTHuS*pL6CVu54CBYaGd#i*>dIo9e>!;%#Q!<=cQs%0SFh|KX5z{ zWUlqU^}G=JXY;t=PpaMr_6ixuByUyKaW1M53 zf3f(Izr}z6BFg$NANuA~pke-V@fKtrEt+5ELJ?TXU@`@ zSOKPaTdz0j_rsXSnJbkZj$FEWr?Ywxi=v0^n+-j*g(d`9 zOb<~UXGZ9O#~Y6+J?y_hdnI~$uo`EIMbSgfpA9{5d=O-w&_it+XBL^qnU5>~pZK)x zE<66W-#?4RQ~6(zxz_*I`BAm?2dfnS-3J}n?JWOdu?KGPHjgumO7f|IEK2b1nbo@qyRwkA-Ud z`u)|sj)-;il+w}7&2~AgBe5ttT68c{M}jP-BmHi`|LuHT_4};#=K{!l9hYmAj^Y|D zeBcoq{Xxy*k=4AfSQH%{{wz{Qg3L2I^4h%bWYH1lbx$iDJu&X>TUOZ6k^Q_*EY`zQ zJRoTO_E`qQdBysM1~S*`$a-9Z=X03z>Sq-HyZWuT$65Zxq5^Od|ANe8{NuSdX8xa5 z)$e%ttS_DAUn~m$Qc7Me$UMeBTDzJ5wW`{~hM!aaQAgvCSQOr+lySWv^EUtMRJE6^ zT=J>2{EJ25T}tME2I9XU^EUs_scP@*^OWx~NA(}JNO)8kP>fYbB>o68kMWPZ-W-3P zSGDfgcUPvf{EI~eAiRD>^e@Of#y_6>Xy$*ts{TFO*Kcx`f3Yb1ODXynWFF%m4~jGM z|AMOao6kQ?k2@NF#G>#nrSLDvJjOqsXK3dCMOE#d!P%2mJIcRUOacO{_%Fyj#y{$6 z=6{3YzpU}_ZO=H$zgTRHhlKL@cdSCf`fr|2B*;9*Kc25;=6|EA_2c(tJ^ZYr{EI~e zAY3s2vl|f!GLP|(C!(48|Ff$1(u>yab(Vjz7$#nA2>*i2WBhCN=b8E6q-tIM&%3{M zmVdE$D*gqT$M{Ee&HQgx)jxk=&+%&=jXz@1ivOLBi3FL)_&;*n0^y(U^Lt5EfAe1x z=SPo!tNSX&Vs-wLaqkY_zaz+8%YWp3mAH@2d|%}jRqd)lcW8CPfA6H`&)crq^&_k2 z>xjiEy(iz1G?(bLp{p&zt zaiEU|;g;s`l}*;e7`z3UYxQ7#9msSa6|Xzqs`#IC=rddV+i#CzQQG5$BaHSq2J8O? znQQrXLwnSp|1ay$c{up8(nI$)DSkWcv1WR(T5l{CMGu9Uh8{RR3o=jWA(v|Yoao4B zyPkf1NaV3Kdk$=|dA;#A<^KVT`qr`IfBW%REGhuuLi%Sx=34(-$79p;Zg_pfc2#eG zmky2W@L#j`XSLo>EK2*^aE;Oa1_TXcuI1kxkG;0uPyc&Xvc87P9ZE-MUeo%F=;_F6 zot9V>9d*kwbo6V)aY5!89eHh?R(Rbg=jS_>jfo{Ypa*tDy-&7Slr%@6V-fmj=>A4;&U>ReD(5cUTnlU^QMA zi=v0$zhUTs?y^8-oKDcROeH;C=eg4Jb{vaJX14ue5B-}r9JQidg<6nzh$MTx0^~~2M&1m2# z|6)-A2p7yh>tB$0jQ{qOE&Atv=yg@^*_)4lW`}?K`Kefx_%rYO$o@x=xt4!7(_cz3K@vbwttkfPz z!Qa9``xRua<=qYQj`})N$@lnr*g>U-f=-Vfj-DQ@u7iq2(ZfHh=|PZrLJzg+I%xRs zX7lxkL(2b$X5Dzij{j>Ghtu)*KzuYLeP}vNhF*QdqLu&oI=CQnt^cjBgHEMs=IcQ3 zDLOtZxY-u}_T#Zw6#hHTGUD-i#AHF{TK?S-kMVR9WBkp!IIQ&Whunuq<{*`Q_=3@-G&{#H$VFpWCA#^BDig!6hDY`GKnS zpjMx)bC!RxXvP0p@Gr_b)U(oOp>-(e%}*v|vR;^=J`r0>AEtYj~jm0BN+g@42dL6EtYcQ@n# zg?NT^iFsW1SEYw%e%O)~Jv~^B%fzDSq4R5zdJtru&_k^pm$42$QvTokufIgm|5o=e zh(+=Lllu(+=O!A+JmLS^dR>kJ7%xja;JoN#rH4HuPmHh=5A2T%#G(QaF1UaAD$YRW zT0K~g3kFlMIWPT0)w_8?-biQp7mN23-47vzpZh8N3o?)KUq(XLT^sw&ZNIeKLPw2tZ*QHrce^)wcH8{ICdOEVo zyTzjDsNc~@9SJf|=&07_-DBZ@i7T9ce5Ul!{ee3(ciG50?C0HLQ2_`SocG;{XDJ9W z*XqGK??yc(@8j}wRqwk$Y8kiNQU1lEw8!($Z5^H$<8iPc^BDhyR4DxO{Nxvk|MF=C zy`smz)qJp66#mDz3i00%W6qAyzaVoh|B>^-Sl=)6!QHSd=}X1?7d;MdF?hdy^iuzA z>Ot$g{oz};W^c?t*rVqwW1Dl-O2u8Cee01Qo5S!f#YqAau@SFzq47wW%J5g4F2xi5 zJK(Ev*po+vl!NW|C?{Y~3F!+!DIZ6+$LC_~??6-WT@lKQaIb7f>Wr<9)D8dV5gtm2 zZ_026^CzEHRW$?J`3{zSeXFX@28^@dwfZPCdSW9OBrPz8H&Q7zu5TRS@#SHet=>y3$Q~s`64!g0jd|LCFw^V)sMtBAIb2W#w++4*a+64)IcF`q%i!@ z5s%3cd-;n5N(db1jYLX_)6(>lHVrVqG}8Q9RaHNnG=q1eAx-@9>@!~BcI1ge9WZ(KLv{<#3_DFm6f`9H4sZ+XVN#8<=PN6Djqx<9n9 zf3di}{qLV>^2+f+Pwlw&`|IXS-6H%8GH>#a0UC?W5AkLDT2)|kLU>%y^R*MjFDvT2 zR4}Mgzt1RH`)~g}0jv4imdawQUp34r7zCKpxUAIHVpOrdu7S+8e&M|JOf+(^OkSL? z&5`?;IlfL(I;!*JIdO$HbY#DMi$w(>T(FLILPvtkwL0Sd?cmAnI49hWdA_1R)%)4B zuEV0ozt#MZSd?}=@P<%3J_POu!v})Qwfyt^Q2%~mT~T;`h-Z2V)&AGkly)kzp?mw| zezCax$(g?_MEq>?0+*FqIe70_$3W&<-p%o|w&wYI=PK7JxGYk7XfmgBXJ_>w7DW#? z{Mpb$6KFz^#q)|8XA{L7txaTicdT937OQNU;t9c-?D0(iD zu09XMdC_F$|5nd8y~IvDu%8!+MFk*SaR0#ZK#;lC|EI`{^1^u$^Z#2_Z*4-c!~BcI z&P1IX0L6TTMEDnEUgO`mZp?XUiK_M14?Z0fJ^fqdrDAb-9A)Af6)jUpl5sic0?gD4 zGS~87EicWB$V>T>BflPOKJLy{j^?Fe@%<@NMy^6$x_c&2I z11LxG5H8C?a-bC#q|I|y4`NaDuw#~?hex0ZK^D_P6!X#?xZfvw;QVBY(!-BqFNvZa ztnyN^D0(RWouLPg4}#1SdZxRp@BIIYRb z`ji_L|Bvrmz33?${M({dy_EhW#s`JXxvbPSLjP?sE)!&~<=+kC1DgM_F;B^P z;dG^kf3*lMc2*B!QS>nQTtg3;SWPL&VtR<;_yEgT3nS*OXDB^%+0i?SdaxQFh(*yu zY70XT93KRkC-hL8#s~UJ1@0fXpSVf+zvIZOm)MC1_WNhCr~rfu=^q4{YyE$U@quwY zpZTAu>izEFh5Odn=%4NLFBYZ!jc9AMKaR(O%wzoH77EFaxcr^s|InVKZBIMOzgS$g zXTznRkA8aSviZ5c{ASLIU$Fi^!dsAejDPTL=D$Mm|CILk7oK&Lf3esAcWods3Xji( ze?jJ5{&`*3EX9A-?ADv?@L#j>!FzZfsh@hK_cA??R4hvT*>Q=Tf6WKN^J3MU=xsz>Cd9VrwRJ)U3?Q5-{Qr$h81AaEC-+Ruyq~oL7GZk@Tn7S zB-8K5r)l^G&o>3RR=1Pcw?()^if=(PaApF>6zt)f*z{K}`BKd50&iA2dh^VzckJlM zem^D_Po*P4=2{(D=MjlCP~s?Gf4xQV|3I%RK8hayR@Yy}V)cG(C31-7nCBN{uH`@S z`YW!u$$g_do}R6EU$yn-h6{6}wXWLg{vWZpZhcmZ1-V4aw{uykjREJ$cz&iJb1m=Y z_*q-m1@axD5!YXDReE@E!+Gh>>Om}u9uB->=wUGKKM`axJw$VUr4(JV`TFZ^N)OlL zZu;oy!D@a*EQ%fm?J)Gf@j;MzLJzfeer1mG|M|^w&$8ox`+1RAQ~<&S_YZF)zZPV! z^}lsqg!U(S5tnmSy^md<=P>_bF-*MLVE#EC3o@_qU#RmRuLY?uhA)%pN(^oAuw5F4 z0Zp#{#0+QdJ4;IG_QWFOLlXbW-;a!cw~J%&v5h z6#1BrcGbp4?eHv#>SMTel&wGPqX6T!lDSuR>a}or*5cbQ-ZN;_=G>Z`ag?%gCC=Re dPo|ix6Ue#71buYK&!WI{2t0n@nf~{y{taHsg9QKp literal 0 HcmV?d00001 diff --git a/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4733.evtx.golden.json b/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4733.evtx.golden.json new file mode 100644 index 00000000000..ca75b7d5c50 --- /dev/null +++ b/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4733.evtx.golden.json @@ -0,0 +1,63 @@ +[ + { + "@timestamp": "2019-10-22T11:32:14.8941288Z", + "event": { + "action": "deleted-group-account-from", + "code": 4733, + "kind": "event", + "module": "security", + "provider": "Microsoft-Windows-Security-Auditing" + }, + "group": { + "domain": "WLBEAT", + "name": "test_group1" + }, + "log": { + "level": "information" + }, + "message": "A member was removed from a security-enabled local group.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-101361758-2486510592-3018839910-500\n\tAccount Name:\t\tAdministrator\n\tAccount Domain:\t\tWLBEAT\n\tLogon ID:\t\t0x4A727\n\nMember:\n\tSecurity ID:\t\tS-1-5-21-101361758-2486510592-3018839910-500\n\tAccount Name:\t\tCN=Administrator,CN=Users,DC=wlbeat,DC=local\n\nGroup:\n\tSecurity ID:\t\tS-1-5-21-101361758-2486510592-3018839910-1111\n\tGroup Name:\t\ttest_group1\n\tGroup Domain:\t\tWLBEAT\n\nAdditional Information:\n\tPrivileges:\t\t-", + "process": { + "name": "null" + }, + "user": { + "domain": "WLBEAT", + "id": "S-1-5-21-101361758-2486510592-3018839910-500", + "name": "Administrator" + }, + "winlog": { + "api": "wineventlog", + "channel": "Security", + "computer_name": "WIN-41OB2LO92CR.wlbeat.local", + "event_data": { + "MemberName": "CN=Administrator,CN=Users,DC=wlbeat,DC=local", + "MemberSid": "S-1-5-21-101361758-2486510592-3018839910-500", + "PrivilegeList": "-", + "SubjectDomainName": "WLBEAT", + "SubjectLogonId": "0x4a727", + "SubjectUserName": "Administrator", + "SubjectUserSid": "S-1-5-21-101361758-2486510592-3018839910-500", + "TargetDomainName": "WLBEAT", + "TargetSid": "S-1-5-21-101361758-2486510592-3018839910-1111", + "TargetUserName": "test_group1" + }, + "event_id": 4733, + "keywords": [ + "Audit Success" + ], + "logon": { + "id": "0x4a727" + }, + "opcode": "Info", + "process": { + "pid": 772, + "thread": { + "id": 1664 + } + }, + "provider_guid": "{54849625-5478-4994-a5ba-3e3b0328c30d}", + "provider_name": "Microsoft-Windows-Security-Auditing", + "record_id": 4627, + "task": "Security Group Management" + } + } +] \ No newline at end of file diff --git a/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4734.evtx b/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4734.evtx new file mode 100644 index 0000000000000000000000000000000000000000..d3d06502c30aada232419ed99b89bf4a137bbc27 GIT binary patch literal 69632 zcmeHQ349gR^*;0R@<>AR64tl?LPZf|7m%gw5Eer~gGgNigm$OthW05r{9@(&zpH+&^YazX6E-EzsH?7+xhNy zzkBYvckZ1GEiA~GRG3dSKR&gi5~)UUL}^;hQ~u-MX=hcx@*m$Mc7qrLF$Q7`#2AP% z5Mv<5K#YMH12G0-48$0SF%VHo==Xa zp>#dvQ!$m{_dI+9lhwg3sqs`nMO27`r8p3;b*G6qt&FBpZ|a19r8EJ1@^MZswmTx7 zggw)!1iwnC0B3f@?-K0qMALDs7-?7PjDOv*)tP$Y|NOA|(uiL^t-AUY%1X+uWNd)4 zX$J0Grdx!-2Ub`A47j93|28v$#^~0shpjxEH4R65;F}?0yzDMNWdUpv4iW`}qy@$+ zJ+y7&r(smCUx`Dhlo~fMjz;0M8`K$J<<>KiHG+oVSQ~r;EIGbS+qaVFa@-;plubhR zC+QHFx}cu|zF-^${91kb33iCm&q}OEml-obdv#ED#1 zh5AXvC;6xuel$}$9XiubWA(C_qMzbpgBrEO53U0IdAvn{Mxy|^SePO4Hi97wyfx62S08 z#jOw!Or(T3ElrmbJ7fOb1c?sDnYj>Bv5uPyEsZq4R$Z+VfD^gk`V=SVL=`~_3@%hx zeDPW{x(X1or~|5K7bs;ADr_dwUPuRni;fUPAzgGx!BL1a41r4 zcUf7#EAhiSaRKqs3-ArF2aMN(x_g)gjQKby)Qd;-rGRiQ#!J<`+8S4;MO--qY_QYk z{2EsSFJH}9F_LqQs}m!x&c=0lBUb$$fSY;bxVP1f~eAeAfQLRWTISL$vi zl*3e%kJXh1N(hRr_EOhgY@lpV<67%n#)q!21?o(&^ecReA#ToZAmlu|D9h&?mQ!>m z5OPI@$TOEuCRpOe&X-aT7FpzI>LBN2e49}t{VTt@O8Bs!D>7emE$+b0a5<`X7YL>c zRGf*rJQP|TOYrsliEo1cu33{5pw``&792VG^i^;SXF7IDBV3z@Qs*)cA)BU4jGeOi z?rk2%ZSd)UZ(q8S;}x7yO6?)Z!PsN=AF|KzBHw4t#qo6}s1qw2fSut^5{tqX0vGD-GK<{T3G}e+Hot*>4R;nog}ys3X!xri1&?X8>DV znpYLxAqU3SNBfHEd#mg?6BAsHwefNzP|_SFamleR^L5Y1!CoQ$O`CspmwroDWi4B9 z$$?>Gx8>F5j$@T4y%M#dlOBWc-PuWnT4-)VlC_H4@|HA0W;lm_sz=$rHkCxxJ*X0U zIQ|_DDsNM{oU{0-&c=`BKebl;{~7%Isb6|O6aQjy~yNPlJCnes6 zQv9(xvR{wIqLq%4QI7?gYjtE@k5R9s9Ydi?j&>+wX0jh%}A86XxL zQi?A19Ce^ExF3M8AagDMf$jA(FHvDFZ)Z)IGj{E(EjORsA8gLMRdmS_^&qb9p*9=8 zxLmk?a0t3kvC@4?*RSl9Pwo8dY70Lr7NvfyO&P8G+0FpG6j%kBYs<&%XQx7#>}OAJ z7doEi)3V{qLTxbjEvI6e`&K-D!yU-s@V}w>@B94jKwLK!MH|_(=@{~lCV#2>L)L-l zVUg0qXN!k8tOv0udRS)C!(2pQf-I(oDC&VrUlTpB+gz;lFfQkwDC*%}3;!S%MGwWn zNdF+nJfVlYAK@QDqhH+dFUI%#<L-asDgRsFGRl8VGLazjMETd%evKJX`etdzI@8mbcySEdOFr z{Lf7%BikcE<}v;;-N~%~<%<7a8T~(XmVdFR0E83KzaaA%{}>ZB^M9Yp_qYkOe!a;? z|IB{-D;C4Vs}1I#`)7j8+x*|Ja((hp@oZ=L7mHT>`_cXiGVk)w;}k1Y_V4_|iC3PB zn*OcEg~X!x|5X=j`uN1Vc*fKc{0lPI@*g=agn1F>aiIsKwwJd%`%l05@z0a(j|-J4 zi_Lyoy<_`th_(;ov`YJFD#nDsyC8Ed?`{|u;`xwQNk5R&l}Zl{Pkwu@vw9GVqK7Rb z4LwZ77_A_S=^={G%Odo^&rKdwdRViteY5E4!D^gPEQ%hAhZ}le{~*Xbp@+IOPB_8* zylj;!|J}E5Z(*nW?Z>5JQ2_`i+&-{B5M-_`f9r7}w9n>#!5>tgdcJa}1i}?a#QT$)(Si}Flfqt1Fb1nbo z_=x9i{sdq9b1A=n-axeHZH5+cm0>Ou&nqp|MU!uyx4ByBD7&D=w{~=7-;at#1t6So zJbkhxYzweq9?r}F*S9sADTX``QGpMSCVg1^;}06fa3&mZ{eW1wOF^Y9g99^>ES zN4a0|u;Rbrn>}`{nC)agQ!G|Kbzt6#*_Z*gh0`i+KBnyR__`o-E&paeT34Sp@>-o! z=6>cHrHA9a*X?mu4`NaDuxp#4hxX8fAdBfCiv7$8J#c^H5v7O2*K2#Drw6NkrdSj` z*%c9HWB9#i~Re%ZXuN=Nw@iwZzEVf}MFBFH?(ziIvf_mdx2`7Zh9(gAk(uiZF{ z)%sYmDEe>mrlEi4Uy!+$e{=u9YwKg78o$22n&%O*j-F6Dy0OJRhjk%?LMyu|~8)|byR7>+A8H8zmBR!7$T8oZyw99KW3 z_}@2Z^LFBTPm)A$!;9^)V5d}jWiR@v|T_Bo$B%fDC@{w0;TT9A2+f7Es}{~J`c zM~yzO;lqylAF(LBODg?(LFR4#H>zweU$gvUXZaV4!n>r*|19`_LFR4#pHbO9G~fx} zBaZ4nY>^U)$F*`467fHR%wzl`t~dLiXH~8{58RjOEdOFr0SM1u5&a7?kMWQ9KAQR8 zq_Th4u1#B=|cRRskZBzi&pY0s z_@8&|6I=Y-ua9C;>f^;@jQThp^Zx~zYx#FWebnFoFZ0j2JNTl~L$7uzemnKCc6zXy zZ!8u?4@H@V9@sw%GEe9sk81y(=*V}we*gTC$a8D=9@rA|eB+&}{D&+ZSkF%R+xN#} zQ2_`i(mo3^*OtGvKQ_JZhUZ7@Qu+3G@6^N&|Fx@sR`dPDqSU|5zclLKkf4Fgwfvj? zvDfDN>3`2k=GSn#Tj}WRU$#9fdOEV2rzI9eM?G^59sL4+T#$K2M_!w!6`nWB@%bL5 zqwOoRTG-K%{q{gCh8qI4!R-P2BSGd`9a*;r$fb-^aJpCJdVKkyb!j&G%l7#fi!Csd z7!D=;oIv_Vg3M$5zx(qP;h*E;eTx4Bhi0yCV1xhKwZ~TD6=E@E*N1rxFkW%;FsD`8 zN@)K@^p6CYYxy^~$8~kQf(G}0GgbOWobFe8IQ(w&4bJL8EQ%i9sWSAi4w?{TF+D_a zeJ=Iv9Y_;Buv>gd>0#NxQBl-`RexD5iXMLVs-Xw=4}#1SdZqR^`71$`oX-Er09yXympz(mr!~Q1So!`?pSRXrq0$&%ana9He7s0ZC_t zgxhEK$AZjb{A-c(SYB4Sp8fKaS&ba!Uo0vB;e`2T{R=XW@!yfMMgQCmy`u6xciWer z*x}!Pd@2^j|1A7xWcwq?T+6>3;?q*Rr!-sQ5l#;&JuF=?>oaHdAQnXr=V>2>`zt39 zj|j4u9-A3}VbRQ$4(mZIiXLXhMe0G2#qN$Z}6g~VQ zDN+xD%oBR>;(I(x{v+5XE-pG(8+qdbnoC4IQ1;gIE+j98HVV zgCL9PA&Pp4`1|wRZoHxN(Bs6GPSMkYRoo#KMGp-d8hYUNLXdev4_=Hr!t)b&Uiq6! zM;E-bxzvu1YB&CCHIH8`rs2&JexMkmkbH-+j`mpGD9Bu^qsV#u#ni<-kN+)|+gUA3 zU$?`%{di9-Hk|spa}1fo@VZsy|47})VJHSqNfL|ewkPlJ#>3H zQV)X66MCqV{W8|U2dezH{p(LrEPt!@3t~~q|M5dc`R64X$UIU0b@jO%1<+p>f536k zhe{6zt~fQujz6&9FA$3gKse#{;fpu}nQQf6-7gqUCFZ#FBbD!#h51)F%fDE>m*`#y zA^hG?;a`w>jQ=v~ApCPZ_>1DdVD9G2_c$6KiAC{;ufG@R4+WWP`FBHnq_2|}f5_^{GEeBi)6b<@Pk&W9YBM~$Bziisio3<4=xET1NF50>Pw1%5#@#t6fAK3Ee|)0! z(Cfb2GWXetJM72ZVo?DICmi?PhIc6lGS}+CI_^e3CGO+&QqSVI= z&u<$Z7vp}gAoCdiMN}mG^Z4XvivNlkh5e$(ztwoKSQP#zwh8gy7=6yp(7zyaE&q|@ z!IKE$MT``)7UL-fr-|VB8A-E$T(&xi|{6@8+z;Zs|r+_aQM*+W9pWyK5Aa?qK^~vwYjd{n{ z`VP2Pzvk0-Gy`kCppP%n^d0^69U7kzukR?(cf?Z@KR_{<#n_>nd>$LY05yoylJqlA z=x1V^&t&+`;}!f2Yy|63YM_WWQW$>dj7Q{*gM1)?5&~cHMj|D|X=(aRn+F(R8fkv5 zx_S_9n!!8bwPth`ji4;*0BXC?Xc`2fGm-W}I+(6NK}@GYx(-z5>cvusVwr&LLXvze z#EtZPJcW&5GBt|x2OCf;zs@)aApU|G^(D-FYl3eBN+bKv4MdrJpG(ZzkLL#c_i$RJ zElnVr2>wLDuC1SL=oc4KvNnPJ1+NoB@zO~o{2BMaycbXR8!Y<&h90b*8;C{G!(VFX zL6CVu4|VCeK`xiOtP}h~FMXmp6aE>+^0(^0h(#&?iv5xPK#+N&{OfA}h5bQzT!iDe zzbQR5zIp#{JO03a|3xgGNe_a|wR*7bzkq*=z;=g~>YKQq3iwRT@KHqq5!0mG( z=2HkVZ}b19;=lD-3lm=o_a7yW{^9n}zW&AHrjEaRtl8c#hdr_TntxuqaQb%PUyyl| ze{|4Tbbg30+t;QNo0G!*dLFNxEakGg-V24ps`Pb6$=ZMW?+I9q*S1y`+x)z7Zs9P% zoWW_8wgJ70P4x|At}PdiThB%%2g~He@!DKjzs&x1iqcWN$Ipu^vY{jU^;;||0O5pn zvWJ^ro6hs2`PhUpfKOAKs$Xv@m zj}HwV6xJ1m$A@^Nr%3I8d3|Y@VjH@*-|rWTs~(^Ivm*G<!(aZ!FaE@J+Ft@5o+Dsh;9vDl5MTO*)Yq>u>zg3N3D8_$h7E}f=wz2n`F zhec2SR&l9V934lQct%Al6_R8;4!Q^<^@7Z`{MU#}^CRL?e&ooX`&&-9ZLOnmsaSlc zy!?u_h)eg+=Cn#1!hHew9YN+=-rW$F`e_K|N*uyzSx64F`l7Uj&gwxdiXL{)G4${d zG$F`hdWd3Nnv3H1i5@sUDOY;cJ{56^o*Wir*S~VE-VX{<#NcI`u_l5LFO_3 z!MBX+Wn^gdFtDE?>X4Tk?={R=YJ@^9`R@Vvkl_=c8t;T@FN;$>iy5RU2ZqQb99`tmMb z1jb9ecxhN62F-HuD<50eVhz%C>W*Jsu#ik&k54mj1n)NmxmL@`?As!&km4n12F^_2 zD90XN#HN4p$d_WC7kH!6(Q9XCy=g~B_S-SBcqSbQGS}+JI*v%Bq2fpR`Rh%J|NHt~ z{z3Hkw|f367HhU+YY;=U#5lhob1nao&tLJxP1cQae|oOseeI4L8!yR=*1T$~^*>^9 zOm}u9**oa z^e`OjPXt*^578W7DMgcPe*Suk(!+IFO&>iySdFiUMbX2s-G(06KL|2U=%LPzugp{B ze_@NfbL^DA{kTXhDgfbx+lMz0UkftVmcMmeg!(6O5vTK2zE573?=b&jF-*MLVE)-3 z3o@_qU!?ONuLWr!x-V1dN_1`TvRxX54o#l^#tdiHoh7C8d~7M=A@P3|??n2)1yV40 zTLpjOo8UkF?|!!KzO>-T$)`_2KBLeNihNB+hZ=pO4tSSD%|2WQ%GO`@QHXxqwE0(e z>9=H6*0Kec92hosTV8GMI9A!X68G+eH&aa23FKH~lHNPycTwOy1Rh^^rvLq_e*?J@ BhZ+C? literal 0 HcmV?d00001 diff --git a/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4734.evtx.golden.json b/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4734.evtx.golden.json new file mode 100644 index 00000000000..237347ad76d --- /dev/null +++ b/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4734.evtx.golden.json @@ -0,0 +1,61 @@ +[ + { + "@timestamp": "2019-10-22T11:32:35.1274042Z", + "event": { + "action": "deleted-group-account", + "code": 4734, + "kind": "event", + "module": "security", + "provider": "Microsoft-Windows-Security-Auditing" + }, + "group": { + "domain": "WLBEAT", + "name": "test_group1v1" + }, + "log": { + "level": "information" + }, + "message": "A security-enabled local group was deleted.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-101361758-2486510592-3018839910-500\n\tAccount Name:\t\tAdministrator\n\tAccount Domain:\t\tWLBEAT\n\tLogon ID:\t\t0x4A727\n\nGroup:\n\tSecurity ID:\t\tS-1-5-21-101361758-2486510592-3018839910-1111\n\tGroup Name:\t\ttest_group1v1\n\tGroup Domain:\t\tWLBEAT\n\nAdditional Information:\n\tPrivileges:\t\t-", + "process": { + "name": "null" + }, + "user": { + "domain": "WLBEAT", + "id": "S-1-5-21-101361758-2486510592-3018839910-500", + "name": "Administrator" + }, + "winlog": { + "api": "wineventlog", + "channel": "Security", + "computer_name": "WIN-41OB2LO92CR.wlbeat.local", + "event_data": { + "PrivilegeList": "-", + "SubjectDomainName": "WLBEAT", + "SubjectLogonId": "0x4a727", + "SubjectUserName": "Administrator", + "SubjectUserSid": "S-1-5-21-101361758-2486510592-3018839910-500", + "TargetDomainName": "WLBEAT", + "TargetSid": "S-1-5-21-101361758-2486510592-3018839910-1111", + "TargetUserName": "test_group1v1" + }, + "event_id": 4734, + "keywords": [ + "Audit Success" + ], + "logon": { + "id": "0x4a727" + }, + "opcode": "Info", + "process": { + "pid": 772, + "thread": { + "id": 1664 + } + }, + "provider_guid": "{54849625-5478-4994-a5ba-3e3b0328c30d}", + "provider_name": "Microsoft-Windows-Security-Auditing", + "record_id": 4630, + "task": "Security Group Management" + } + } +] \ No newline at end of file diff --git a/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4735.evtx b/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4735.evtx new file mode 100644 index 0000000000000000000000000000000000000000..47e2d9b3f4128741b39539624d5b799515a88bb4 GIT binary patch literal 69632 zcmeHQ3w#vS^**!NEJ;W<39tA7go+}_QvpHb4dG!3Xb`Ebnn*%H@}MMVn6nO}Of<{y*idBpCfh|~V_4iM|Gked@Y#1<3yVK14cKI!Lc3$VZ z-~H~n=RRgKsBm27gu()<`SGb8l}I&;BTCb1p7J06PCKjmjsN&2u^Yq~h%pdjAjUw9 zffxfZ24W1v7>F?tV<5&rjDZ*fKghtK!f^w}7f(bVKlC|WTFHkoC@`cx(UFzurJ=L! z|Ic=`eocFr@6aqj^nE>|6Y)gH{N^J>trCcOVHo1ae)j#qHIKt4f11H2f4))Yzoz!{ zz9rZmoJsjs|;+`+nxDTJ>#OFd8&@maS0@rQZqD&Kc zj3@Nb=B^q0+MFsaRnsV0yKD4Pzg)@NAHID@&ZcpPdiHuXx5ZlIgwN`iPLE-eGsvHp zlH+L*-9iOaOl9~z8{fdq>fol-c&eZxD#SsSP`uWa#^baynnagVNBk?LvDj09bMmm= z0qF$nnM@`4RYK!%W(WK(!Tydk1;>h!UP7JluM4(1QFr`b5H?>L@yn-GSD!>#Nx7Ab z3Q!JB#huG^ix7Cf>gt~Ymz3z=rX|ow-TE!Cm5;L~<7hX0GewM7-sh)mfGxs7qF|7; zz!;^6HjVu>n9B7laVV8iLS<>C$eFEA~H~+125MNg^G6w<3MQ=V@W!gs5CnkCzj%$LXkiT0d}oiw0HDK z0K?-Iw?aTLkrLvxG+j>YjQMjrBsu_R=0QlsI&LnsG}8Q9b+t|aPUM2?S)8B~RRk$8 zxKLg3#cNIJT0qFA_Nbzrp_KlpuvtiZARPcMIzSMGbQ3P%Qtp85641zs=d$Pz4C17h zbx1&QbFq~Jd5B`7^KeE${Pno309}JTvvrm4WNH}a52jN~KQ+Lqkf#2HlF^`ra+yGl zDS^^)6jcCQ{7s-F{XBgq{>#L#G)l!+qp5K%vB%f#*L*{KT2$UYJLEV0DB?=ow2?Z3 z>R!`#ZH|+yxsN0-0KJZWkK7iSDgFibW|5U3#B#*o7~RwXW(rtDRI{W^&-f_e)fce zkaD}r%KA--AKr-zh>u=?Z-6~uycX2m!(?DAz(Jv2JfbfJgmW=orta0oxH2u`%7I{m zoj&K+xEgr*YQBn*oNHX27;$wDuFEH1ijNxd`IoBmBXH(`)0^mKT|Wj=xiT(vWmk2j z?q)(cOhx%vU1^|%px7!0GmP?L17&)RYprt`AG*F4sI$P*FYqmfxH-Rpkn`-UET3;! zPSKq}$Q2bL&s;uPV2K+$UrN0*TIAM@y%M{}a@Z;}l}JM9O3owawV7d&T``x!5M_m3 z>r~iE#1(#2CN!(4I?4DprH1-feslHnVL$)ol${6Tyb-9m=`V*%=?sx}M$O5B{}=>x zqX_K_f8rbCzZ+I11*lcmMdJ=0f9_g1qthKbsS&QtNB&r6AvPxKvSzgAySHA6+u+mw z3~1WxXXx=$1Ohu&U}-+$u*y}X-z-KNs?a^Armg4r%gS$IH+)pcZ>3?orr%0g2BJ6Cp`iPPG6xuIa4qom0wTh?WP z?)f;_E5yIabFS;$d*Slz#dlr0ckrk!`L(&@DCJ47L2c-$#~^%nc2c1hn%j_Mt>W(d zg$`QI4;5B~f)Zs>B{W{sonHt6a`pa7bt4$MT#b2D4W#IoF#sBOH zc^^cN{~mfh9uKjxQ_(+t#bN_W(WRcN4m1Myeeo4!uH`?lwSLy6Dy-%0?6EUPt$wq` z#^ZZ}&3LzpE;*v^&(%HDe&QFG3)hb{)RTFNm97&n`PxqT)XvYYu<)~DQR>I)lo7h0 z?F7J!fK`yWwtUQfb`pfie)iOMp~ERYEeF0V)CP0kauT+=Z^h#`+<_bd{~LGss2*;hpYq9!+fQOFBS}RSPx=R^sv~Zhgpcg1X)ZEQPcyMz9xELx4A&+ zVRY^TQPjhO7XCpjiXMuCk^VuDc|s5QKf*tRM!&e@UySdW?OqXy6C6D>Z-X_Z!n5t~=QyC8Ed?{0{TXj;aG>&@-peM%1#cif*DJv~^p zgJMzi(C3{)HkTC!2@D*epZB^Z$^__vo?Hf4RX%|IB{-D;C4Vs}1I#`)7j8+x$PQa(#S%@eF7A7mHT>`_cXi zGVk)w;}lC(_V4}uu{U0fn*OcEg~X!x|K%5J`uM~Lm}6=I{soz9`HvhI!nz3axX>d~ z+soUY{l{PZ`1xe}<3eT1V$&Y9>JAb>ixt;R2AD4*+v!f&XepDw?U+{G0t~U7c^_=Vnft`}N*kf%_Ye zD?J>zMSC@Rda&weibc^w-X9D-uzwI_p3p;G>Sq?4`1@H5iSGTEQuZPq+KsbVJs&F;MgNW8HT2K?3o_U8Z|)y>?fF=!#!oWN!s*jWN4GWK z?XZr-qUdPRp-3GGvY3warvd-B<8?Kkv)11WVAj!ErK7lp3m7s3FR8@U zg3M$5qqdv*U#GG?e8hPTRyyi`#G>#nsr2gwnYa00ud=;l)sj!07s3FRAEXka>)MyeQ7h|BEWyZ@us+J>jVT5sSjR zq{6=-^BDhlpP`xmmsGZU1!qlM<0$`P5mSg{<^Khl$M{EH&HQgv{FgNuvHe*``4@{# z@M=)*|K=(rtp64nM1ss?{Nw#vX8t#+TtD$Z_M^`^%D-4t0Ky6LKdUj3AoCdicq5vb z|39dFFTG^lK4d8PD$U z^E-mfwfsjuSBdB7%+FPBRoSi{JXfn9{(C32f8TcP=8vr2uOk-A`%IdfG>7Q*VVqWJ zS>XIJd_mgRdZS ztsboBflSX)@w($}ivQV%KeNTZ{rV^tr9NIf(x{JPu>N0=xt4!7)JOgO|FZs^yMwPN zJ@jas;}?>zUVwM4nr__rR8z*BftF zuWxf!^mJskPD?C`j=JX=I{G>MxFGY4 zj=Z)`E4*%$oMj1 z*QD9#FWcu|EH=kVVmOrWJc0C&1ewS9|KMjS!av8wyA}U?_fK1!ZiD~YwZ~TD6=E@E z$H)2U7_T^ffYT~%8MOZj`bUDywfvjg#0|d@gmrJdh@OV7K_1(!=6@!=tDNtNyZB6g~XrO+ydt9|V~v^iY@j z%MH!_<-Mx>=Wd_qR^`75$`oX-Er09yXxNsS(mr##Px1e|hd1Bcz()IQ zpMSA_}3!WvAnKwJ>&I>(;GU3;?q*Rr!+_65l;6jJuJFw`WMdX zK`e?M&eJ{#_g9V~9uZ_QJw!1+Wjzcq>*0XX!~AK>9M*$a6g^Cfi`0W4i|HYXdO+#p zuaLtp$lo`5Q|Y0}w8}4?^$%iE^zdyPI;yMVr2Mz4OU&)e+e!~Bm+olqtRBRo=;3Ipp$G043bL3UqS(%yqKAV@4>xSP zwS%*I5R0ORLurwE5M(huL{SeBe}A6ajdzqDx*glpF?xEiiaW%j=%GOaLl4|u2r^IT z!HaQ6czpt|D}Pt%=z`ZamfF!#?Z$tt*71wQG`v~D4-_L6lJ7Cr(GCwc3NqK~C~_Tt zF?BYt<9|=(c6y7_x9#w5Ki(6I4JJMIU?a?ncbm>>mG)2y{uU1EuOM?R?`{}()Yq9x zyvOrlhm;-)JFh$vJv~^>gNjAb!#`^1L6CVu4|QoCH2in7c|PK>D*wYXZ#`!Tp^82^aD#UFC|fy(vZ)}O6+mVdEm#s50+FUUN` zf3fj?EAA&8RoQRS=+3XA$G=s-Of1&qe-ru!-4PE6GS~7S*)PKcpSfT5p~`mY<^xym zwBdK`#{pt-^!AG~cA{T4c^{`$T3_^qzef*2khzw3H^c!&c!%_4bHD7*N)OL|w>3L@ zda&x3iAB*vm)9fpAjmwShdS9WV;y{?%74qh{ussbw|ag-EK2!5wcjZJ{6qtpC(6IB z&dX5%{blh792b48^sx8plOyf;1N;2~v8Vuq6K)^AiZhV8Ru9(wf+195j!QpL`EF5I zaJ94ii^T_t9)u9W@BI}11)0bAFQfLtKi7l5DE`OI+IZD2N8=;0DE{#64`X7tbks$Mgj_PdO zos04pzryjyXG#w}9=bbgw~e^Ne%vh<6@YNUao^o|mx3U3tsbo7Zsb$qK2ASZ`M&p~ zR&jeAgmwVx3KK% zS6zKBV4Qwo{mhb^T1$@Cc3i!491cyia zu+tZ;Pkujc%sal(cfh^+HJ`qtDOmFbeSC?g@93lN(D;maeaAR`M?5w50~CWi)QCChv&Xn$op2l(MNksO?N6s6U9#LfQlA0J<6lF@*~0CQzNH z7fT_EWh}M}N%AodH`4R*EH;A4)G*E;OsAH9opBIA`~@@WOIZ2V7~gbCBm46PqRd_| zCT8!!yg{E`oK|Uz5{SlwKT)u2>!%y~#f6ltjb(qq&xxUU={OSpjDBSHE2sJm7X5!i z4_5OAVo~()ml}EyWS-DNU79z@<8qhh1i#WtpJ?XTe@3zVt@;9ufrPXDg>@6)8(VgAKp z0@Z`hH|7nveJ;d$3PI*={!b|WTb(s8@wIUOQR3(yZV&D2Uo39u@S7)_zItNt(>rhY z=Z*8GY!&_mnK$`I2aQGNhxl@Qtt+uPA>6O$@!FfETvpV3xo~im{+v;=_TT<{0#@U- zt(3*qKWmg%I2bUea$2RWL$6{(eFK?m%Z20Cvr);xGI?>lHcy^kX8$@->8RdQ=fxG- z(2@Q6Efy7kaKbv;1sw@8*XoGdw?n7ax#nTLp;(`r1rnQwzPAx4c*)C_lw2lPtEvg5&UP{7dfrc zD!_ZEdImDr@^1E@bv4e{8&{d9;Ivrjq3P@{U7Xc}SQI_n@&`i?O`!=v7Slr%=fg*~ zgD)06aLZq!^w9jzmqk$zR^vcoQS`94hJO%bp3p;G8VBOxU40yg@qw4 zz0MHs0UWUl4EMqFAD5ts6mBYz%l zG4}4&j>e^8@%{4ht5+i~-7|yJDs3S51>koCnQM7>LtN^ofs`k42&ZKsInauW(&jm< z2eBx6*g4bC!(-5dAdBfCig9Tkir*)C;P|9m>EZj_%c7_UtGHAwiXJL{ZRmmhgCO&S z9_mtD8lIozxabyD{x5E>T4=`~*pExaBHn0x)o3VD;!tTH1et5g|1@!FNkm*aMe+Yh zMbG=453JLSiYw84<*Z41u z(En7G>o+IAmA%GBd}`nSh(&3CE?OGd{s=OU@qhoapR?{|eafwh|0njZS@g6G{_T%j zi^a8#U(R?6{ez+woK|U@p#OI0mkBc0^6!TJ0nPu|7^md8aGKJ?zgh+tJF5q=D0&!j zzM+RKtfmxXF+D`Fe}HAIMG@oH)0G~&?(7pqJy`V*#G>dSwWXm4_78&06MCpi{R4fa z0=Ey`PW(!hf2XUjTVlr_*l(Z3q5=?3q5TLJhg$qDBM32{sozL`R8?AGZp{Uv)XL7 z!+-7i2YUA~^w!zg@7mFk{dP<&o=!)C%(XhQjw2Fj zkoZxaf4yDt|4{F%K8hayR`ai7v1U8A3Nb_rjPnaJ*YY1Z|B4wmd2W>Z)3X%stGC_O zXkmV|)>T_Q|05RHZ^&-BAfIUY4o<7IG2lEI@6QxuuI1hAKkMqcKz>3rV*d3GrH6+% zUXbCe9>k*P;oz%=9){rg6G0Z!Lo~-%O3@^n=U?wsdbkNs(??GaR^uyTQS>l)r=bV- z4}#1SdZ@GGE3;MkU)VhV96RN2KQ0oB3P3pF_Te4G*MiKoDqq5er+#OWNB@8ee% zILyCT3=^+5n1A-ig3N3D7wP=RYeDLV?#m>)23;GxY?p?kLzAz+F~gbX&XQ8PKe-6; zkodof_apt^T~aW3TLpjO8{$N`sh%pdjAjUw9ffxfZ24W2SC<8+ZCJdTbG#P#T(C1WXB_GD1KuxAPt<5w|Fz?mKKyBPaB(Nr8OLfVx&<6k#yb*7&9KR;}~G~$;}tFAtQvXXKu z9vz?@nua@<=@udI0oB!41DBNO-=`A~d^1Fhm)+y1Y=AAqL84%g zw7^)Uhqg`plu70Kl{l12sc{41Xar8XS)K7sZaouO!)P#$wZS*QlH=R7eK(0N$1QR} z*(79tk`95X3;HSG3&v5vuhplYVTUOFjKq30Mx8bZOcmjnFIb=aew1+w{1A!f?Te=@ zoXBOx_0Sh2KFLST@S~a1>5%Du8m*VbWc?H$8`P*JesC4w&yy_zG!g~K#ljTvoix5v zJhjFTsW~^kmOz)`@HCWLF?h@a?|f=JHSvS?QTVYy-Ld!G^&Iph5>;t{Vy!?@-2p(j>-`bTCnAc05ij#Xp52ff54jTDfR% z>y-e8Cn|1*fM6me#A#`|oY)!j=T=B`5YEhnkcxENTxe;e`L*h5odBH31=qVMK_{vZ zQebeQy5fu1n$cB&kWC#>MY}*L15shKkoH142wZf8APVRPT)?H=5!=O}krmHnF%THU zNiXl1fa2z2D+lrr#YE@ejDYy-30VQU5_x9pD&NV}D9#^jK&|}L5T`<#`WH$@gBHqV z0yUuoYJj7t0@&hj0ww9^={xaX27aYcD!v-!#PA)iwLwZlny>HtlY<2dJ#&-^8wckk@c6{8mqTlr$&-fW7>Kt5`N4^vvHRAIxQs+nD%mJr2(2cr&45V^pTPp?sgmRdQ^0B(oKnX#y)n4k_3k{SFYFulb%lOdswLqN(mVSwE5yZ{;4TPL$7iIZe z!*Yu51VXN;0D0!}$pTB<*!fcGoz^0^X6%*NJ(j~(nW;n)LRWGgxkQ>97TFbZDGXIs z*tJfBtwdbmM`c2@imH>0Z!>D7f8{qJZfQQ^u*y}X-!4HKs?fcrrLE`q%gS$IH+)pcZ>3?orr%0gTKd#CI;9jCSNa>KwnM@dsqwyev1 z-ScsUh{ zg^iFI&Y_>`QI4-oB~f(`s>B|Se}{s~yHqY`EjXmJ@l*Lvtrh=&2LFEQo8H&NzgS$q zA-mOrJfd~SIIYrze?fLyP1lC4{}un^A8Oa?)K(3w%SNyR?8EQC>B*!M=w* z57++!)PIgYSSi=TD@~>D_|*kbNmrav0WXt}ebYcL*Xx?y1^c$BMoZlh-X~Z0h}=ox zkN%tW!#ZL;{Z8LaG;UB*;yozEpQHO{h zTvvjkjqKT+>@RhH$T|=`%vXB&V!>dC^&l2S4@*pXn2iWbkj3;6MLlroYoZ5sn+ud4 z#*Di!ih8);!as;b(L+%%(mx0?Pv{}t{1tgF$K^ln6FP9YOZ>D@ zmH#tazWUBi`(QtQ5{qZ+ol!({3JJFl$!H%0nQP16I)2jnhvTOTw9|`JuD?pz8FydQ z;@4D*_(?2QetmzRawuZ%H_wm#0%+0@JFSC17G$pF-yAtp+iW;)BiShV8bkM>uP zd6$14r&y-4zvvG~Uwxy0HoLTX+tyzbZO!DgO1m@_V?y9vkhzw3H;fDMe8{V$AIRx) zrH6*czCYVpJ%~lo!=~Ye9!fAqE68Gch~o3I2tDv~lZTZaR?TbQEP8sd8YdKsqKBfP zh91~I2r^ITp)QRRjyFFqTcOH-=kK<*uv7l_<5IDx0E826AJ`uVGS`;B^|%n)XLG;c z4=UdW_YXhES^mXh2BxMXKnu@T5dH<3$M}c%g@2xR_lV;E-PhwQ?C@W^_~?kmd;zg2 z{x5a3;s4%7zf6$1mVa}6#Pc?PhOhm(l&7CJ5bb%Jp+#I}n9IcTN(*$+{I>101sELJ|Vch0hzm;ttl(<*H)rtI_h zx*&5c|7Jg0SD!cXx|tK^e&#Brha;D)+2yPr#G>e7#}-2m?V$-l7Slr%`>mV~C-hL4`k6)Me&*w<{7-z^ez%?Sx8FXC#Z#5P zAaiZ`TgOK=<{zw9{P)T{vd3Be#bR$P@izA}rF|A;9^;=5KP~-CPS+^@_aB{6{g93L z$iDu?qUe9vPQ(AT#5ju}^BDi_BIh4Gq4=*n-n`9nNBI|v3P3nv{c}7b$UMfsY5oEC zlb=-iF8=P~{&x7U-8hTY`dG0j`fu`%p?~IIkhzwBbN|3=>tmrBzrMbj=Mk}vo>Drx zrNwTCbtD!=M~e?d>PV2qbfm8a{NIk()m&$-zZXEp>o{GjbQITU;RBD@Xb)=VkF3Uh z#iHowz0V?bB*;9YBd?A7mWYlxu6tVP=!x-f-@4LBJu^EUs_sci4>|CH}BNA(}JNO(aRP>fSZ#Qz8~kMWPV-t2##SGn#yV0V_Y{EI~e zAUuCX^e@Of#y{TsXy$)|%Kkk&Hf(m5f3Yb1ODg&oWFF%mFN!ns|ANZ)o6kQ?k2~sr z#G>#nsqinzJjOrXXK3dCMV0M7!P%47ILg0ROacNc|1Zcq#y|3E=6|E&zpUxV?aw&M zzgTRFSA%l@cbr1P`fr&|B*;9*Ki;op=6{pQ_2c(tKm4qt{EI~eAe=D&vzrhJGLP|( zH=>#O|D($Hvaaj)Im^FT3=^+5gnvQiG5)oN^UVBjR=KYD$D(hYq|v5wBXu5zo&c6H{RTK(|fJE{HqwrltN$m;z%VzInm$(>1aiC!Dd zX_b}*&L6>7khzw3^YiSwI^Q*79Ua%lKPf#tTDmLFjvnkk2NH`ze3XeL&EY4TtcS7q z3NqK~!TLFnX&n{MJKm=FpL6&#Tm0Lvk77~k(i z>fgp|jrun@XdrVf|7L&ewfTPf-?NhWHJt8LIy&>(wr507M^^K+#G>e^XRe{6U%-zG zGSBG9YxA_i^F}#7-=%c4b$NCRJ36x89*D(oL!dUeJz#$%$Xu%<>-GS-lyM49Us1Up zTRw12nvMRleg4H_3(O>jLkT}8kp7V%^BDgh{5(bY=eT&c;(zb{>1!L<;J|-iT^+BWLH*uImHrW@dz2mye9(NIvw9GV zqKEgZ3_YxYCIneb4^dp7OFb_Mq=_EbExxMsuw=l9DC)tgzbqC-55IlG&;$DiLFNfP z)TRD%BXfUwuPXmLx6gUrjz6&9K8r=G^4|ny3NqK0zjb^xe9J6ppE=#9`2YQbn{RAr zqkXo|zgRpFq{C+bNoR$G+h_L2g3M$5YmxIp?7v9;U}d>Oqjj^bkco zp!D%q$l({{?;E|L^w4yA<(JO-2eBx6_&CAP!&kwxffydJv1Eha;(m9=Km9$YOekVmot^9u6u! zT(|A!j?U^qEQ%furA6vNkj3;6MLk6P{dsOT-d1|(adcCs=;^^K?huQjhlULeJ#c#= z$ULD3FUB3=`3XF){2isE^IqLpYDY)48~?SM$1fJs@MZ}=P>fPYe!y5qdn|4gWUkdw zSCV9|E|jIjFzQu+2P%OyeAeLmOOHQV>}n{F@w`8?ST~hEgaNeLFQWC-7xN` z&oh;HkDrGfQhF%p^5}cf(}UG>P_Za__(u&r2r^ITp)NfK4gcM2ejagHmH**cHy^Q6 z{G*pfJ{p!jJRK%OpZ;Res{HvmxFB7|==iYU7F+z=_s3#U z`0qT+@W&hAlLeV;`FDdq#@kJd{x|F5J*9`=9B()yz>`~!Ljg3PtNyCDuJ#5<&?nEPdaQF?gh z`>om0(}PvNOe~5Xy1f>u2SMfuJ=Dp58SCI9RsLK4^`|J7zt#E$u_)#LfonvWv&Ajo2Rh~jhUu2e=9q6dC1{i)K! zyQS;KL{AS^&!xqp=wbcGk$Mnhp3sA*pG&iz{-$))W@t`v^mJqucZ)^Q(ZHjTIuc}_ z&{3U@yT_sY#jkMu@tM*?uLthR+HE85upf7eMFk+7aNKtn-lZVOT&oA`xEuMDxR2A% zRlXN})H-gDqx_3SsgLKM+crEd#{FPH<}v;YsZjXm@yRa~{}s~;`bLj`tMOp5DEv=s z6XL%y`kbAie?jJ2{v*eOF~48NgL`6H(wB<&FM7YX)!_Y(G0Xh7s~4^F_J?oXma}QX zq27I78P}4%Rw`C`4roArY>vRU6gLUnh>duyJ55B$REEFWbP3+*-wB7tV^2O6QZBYT zBAtXiQ%IixN)vEqNBl0v{!TO%$BK}4#ah|U)D2smsVDx=C%lvpN6K&q^Dm!PT|EQZ z`3{zS1FEaf28^>%Y7LQQ^ub0jNLpYlZ=_Oc+<-X3>&xk8{6@8+z*0Wor+_aQM*+W9 zpWyIlA9nhJ^~vwYjd{nn`VP2Pzvk0-Gy`kCppP%n^d0^59U7kzukVy z3$Q~s`64!g0csGZCFy4#)z8E>pULo>$1C_5*a+66)IcF`q%i!@8IQ>s`}jZtB?ON1 zMj|D|X=(aRn+F(R8fkv5x_TgPn!!8bwPth`4Wn%80BXC?NE!&Dvyk>eI*6`7K}@9r zx&c(@>cvukVi}L^0+M{p!;SQOJcEs3GBt|x2OCf;zs@)aApU|G^(D-FYl3eBN+bKv z4MdrJUP#Q|gXaeQc5zyzElwbs2>wLDuC1SL=oc4IvNoRm1+NoB@zOCQ{2BAmoR?4b z8!Y<&h90b*8;C{G!(VIYL6CVu4|VCeK`xiOtP}i7FMXm}u=j}97(&JXeB_}Wxrb5gip&*QZ>O1Z48_fkP-mA=j>S^IDQ zJprrn+SbZqo1Zt%Eyx7SX`EJR>(Hy%P~Sl2+H&Ez^-NT9uuNVYug#V9%j{n#D;?E) z@|?Ir8#=OIzr~^g5KdS}yPzXM=2{(b`*!H$dYl`s$2?w9pz{4}T8|OY#pe27PS3f2DC)|PfDvY~tX{eH2y;>np;7s7wG zdx6s`tpdDvu4f=~E$?RkSy$tHy>XT26r2_*Jv5ust(&uY5R0ORoBn9%p&2wG$YOek z;`8uP?cs|>58Uz>D?POM%f(UDgVi{YSQI_%t>GU8nJ4s6m&Sp3cvl|>;<%_pm4BP( zn_q0lAJ~tJ#G(QaPPlzwe;~+QTmGkri}J&95%d2mm2YiQvBUg}#co918Ue+8g+%xl zWM1Rncy7#b=@gagZ6AD^89n`5#ie3#WE^GT85J#8NRsh5=mLz?3o_U8Un4HfkBCe8 zkt2T|Y&rg})sDucV)6a*@+(#&F5NSe(<*H+_XXg01et4jcSBt2r@@pfaR{enAvw^> z3)1E}s|T?tde}M3(8D9pgdmIQA&PNnE{fkLdf@n^TE&o%*rNt3( z=~Tu4Cl$T#b(Vjzr~rf$;a`w>jejF9W&KyEeBbr|mB*dsUo6f(j~-_Ik5fpPf1Xn( z$h^jXX@vf#sa(G?<<0ChHsVwJ{zoiI`*Xpv$o5B&d5r&im;ZuwFY{AwR{TG{f6d~j zZ18V?+*&NIZSqq3ljt85w&b)*+XVf$N54#vxt4!7^bctM$Hq7%$A#0C9{$xTxWrjK zh(*!E&~ptvWMMX?AdBfCiv0sjV=asrx1OQ&(0ymWDC)tge;^h`52>vTJ+OZeWS-DN zUFsj`GZnaf;CABIs{A`&am`XY{=k0wEEW}ja3bx4AaiZ`pQ3+YJkMwTXR3U^``*I+ zYi+d8_W2i!QvXJ^H|ihzV?pLI{;`BY;v-Ifqxe6(H);FRj`A-SSMS|;$>(F99=?2j z-qqjCS@|>8|3~-=GLP{OzRmnsD*m6+{`SJNj`A-S8)4N30;6#MO!yaM-sPX?bmU3X?<4h7-}Jtw_mPT4@ju&dHvA9kUy!+$e{=tU=LNRFH?*`1@1VpM zF9Vx|a7=#}6@E?9mv`|ZFka%tOT!8=eShF2lg&3kG#`y)AYx$3S{)#7VvTl_7)3X)t ztGC_Kcwt_&=2cs*{}GGpH)OY3kVmv)2d7oqSa6<<_h$++*Ya-mpLKO!Ag>UOc>a2u z(!+xr&r5e!4`NaDaPSpF4@0s3M3BYw5Y6$GQZ&it=dZUbJ=}oR^wHCU)%c276g_0_ zH1xp!L6CVu4|R5YWsWNU^IPPdWvBe@$3?iT9CQ6{H^06)IW)fIGwBV zeeAM)hxr$aVdB*W^UwZRka>;&LY@D3El2~mXy-- ziN%PA#Q#;iAL;+@kb=S6D) literal 0 HcmV?d00001 diff --git a/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4737.evtx.golden.json b/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4737.evtx.golden.json new file mode 100644 index 00000000000..dab1408d799 --- /dev/null +++ b/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4737.evtx.golden.json @@ -0,0 +1,63 @@ +[ + { + "@timestamp": "2019-10-22T11:33:57.2710608Z", + "event": { + "action": "modified-group-account", + "code": 4737, + "kind": "event", + "module": "security", + "provider": "Microsoft-Windows-Security-Auditing" + }, + "group": { + "domain": "WLBEAT", + "name": "test_group2v2" + }, + "log": { + "level": "information" + }, + "message": "A security-enabled global group was changed.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-101361758-2486510592-3018839910-500\n\tAccount Name:\t\tAdministrator\n\tAccount Domain:\t\tWLBEAT\n\tLogon ID:\t\t0x4A727\n\nGroup:\n\tSecurity ID:\t\tS-1-5-21-101361758-2486510592-3018839910-1112\n\tGroup Name:\t\ttest_group2v2\n\tGroup Domain:\t\tWLBEAT\n\nChanged Attributes:\n\tSAM Account Name:\t-\n\tSID History:\t\t-\n\nAdditional Information:\n\tPrivileges:\t\t-", + "process": { + "name": "null" + }, + "user": { + "domain": "WLBEAT", + "id": "S-1-5-21-101361758-2486510592-3018839910-500", + "name": "Administrator" + }, + "winlog": { + "api": "wineventlog", + "channel": "Security", + "computer_name": "WIN-41OB2LO92CR.wlbeat.local", + "event_data": { + "PrivilegeList": "-", + "SamAccountName": "-", + "SidHistory": "-", + "SubjectDomainName": "WLBEAT", + "SubjectLogonId": "0x4a727", + "SubjectUserName": "Administrator", + "SubjectUserSid": "S-1-5-21-101361758-2486510592-3018839910-500", + "TargetDomainName": "WLBEAT", + "TargetSid": "S-1-5-21-101361758-2486510592-3018839910-1112", + "TargetUserName": "test_group2v2" + }, + "event_id": 4737, + "keywords": [ + "Audit Success" + ], + "logon": { + "id": "0x4a727" + }, + "opcode": "Info", + "process": { + "pid": 772, + "thread": { + "id": 1664 + } + }, + "provider_guid": "{54849625-5478-4994-a5ba-3e3b0328c30d}", + "provider_name": "Microsoft-Windows-Security-Auditing", + "record_id": 4668, + "task": "Security Group Management" + } + } +] \ No newline at end of file diff --git a/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4738_Account_Changed.evtx.golden.json b/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4738_Account_Changed.evtx.golden.json index 2bc9cd7b28e..e3d1af0b744 100644 --- a/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4738_Account_Changed.evtx.golden.json +++ b/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4738_Account_Changed.evtx.golden.json @@ -35,6 +35,10 @@ "HomeDirectory": "%%1793", "HomePath": "%%1793", "LogonHours": "%%1797", + "NewUACList": [ + "LOCKOUT", + "NORMAL_ACCOUNT" + ], "NewUacValue": "0x210", "OldUacValue": "0x210", "PasswordLastSet": "6/9/2019 10:30:28", @@ -51,7 +55,9 @@ "TargetDomainName": "WIN-41OB2LO92CR", "TargetSid": "S-1-5-21-101361758-2486510592-3018839910-1005", "TargetUserName": "elastictest1", - "UserAccountControl": "-", + "UserAccountControl": [ + "-" + ], "UserParameters": "%%1793", "UserPrincipalName": "-", "UserWorkstations": "%%1793" @@ -112,6 +118,10 @@ "HomeDirectory": "%%1793", "HomePath": "%%1793", "LogonHours": "%%1797", + "NewUACList": [ + "LOCKOUT", + "NORMAL_ACCOUNT" + ], "NewUacValue": "0x210", "OldUacValue": "0x10", "PasswordLastSet": "6/9/2019 10:25:21", @@ -128,7 +138,9 @@ "TargetDomainName": "WIN-41OB2LO92CR", "TargetSid": "S-1-5-21-101361758-2486510592-3018839910-1006", "TargetUserName": "audittest0609", - "UserAccountControl": "\n\t\t%%2089", + "UserAccountControl": [ + "2089" + ], "UserParameters": "%%1793", "UserPrincipalName": "-", "UserWorkstations": "%%1793" diff --git a/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4754.evtx b/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4754.evtx new file mode 100644 index 0000000000000000000000000000000000000000..db249481555e46bf54078ca741cf72b2fd8a8615 GIT binary patch literal 69632 zcmeI$YiQMV9LMqR|J-(V=FYanh*Gn(Ok-2iSvI@aE*UMewyfyp^lUmk+f27|*#oJh z8w5s05Jg2%J}8O^!uBAD9t37WSWrFcNj)pOkPm{>=lj2Owv}BW5Z?dsKmW_`_Wiwn zm!qe%JkT{*?zibjDt@t7*TB+djluLR|M|J`w91kHTnQB*fB*srAb&1&TrnUYXPjt+Gcg35B9y%H{1cA*6 z9^UX=CMoInUwyi-XJX)swo5+TIPVSh#B;4_vX^x09rWYijI4FqUDj{IHmc_bb>_Ck zi4zT3+igQuR^l!tWP?`Qs%)dS!!EWZ`rBoj^`>8W`gGr->!9B3v=Kdx*no1j=y^o% zm)PA(8`kv#TdKbmx?5@&>9ha0=66kbN(Gh5j~c6F+(vqH)??$Uc{FTM6MRjjaVGmnx<$mkH|Z zY`sWk`f0T_wjs_oD5+tkrHXZy$!Lt{>LHoprNde4Rz@GIa+t|HQ_5!RVRk%EJNIO) zHyn%YVV0CP7}z{L_!98r^|?8_Rs-n6;zZtD;5B7!fgX~Tv+d)&U9IGCjoXMEOLF(D zS(}v+`+7a>k85mutWJ#%hNkVx+OGh7h)T*6^7tz9IkkFEVaf<5g~XGyrgTuyY^m-g zUFrHs+SjW>57{G$YCU0v}CFB~h_8r3+e zzt zx=Pn}S+rp=_$asNengBu<9#fyPz=c?{d`Ma!|lU1rpO~=von<=m+aRA-8s8K zefHMle$TL(=}fW7&dS&+%Brauo|?(}LW_Etw^^3ACZ%c#=+4i)6~cVsOMP_dsnHsA z26kuqEWJsseB3M4F>mksf#t9HzM0Vw?^UH8af+7v^bM?89=>sv)X%#WYV+^<)T}u% zrgZP2=iFlFJoP~D?%pS^dimg`ZRzvgub-|EZP&HWE;#C&x*vYu`op8Qb$-2n@%ZX9 zKDk%R#dB%YcIei>XZ`57&!<$fU3Y{-(5Lsl6L#wA-@87u9vR7Kck%)9)N^#^d8NCDTr%8dq8>JAeEz6pHA+n=Z*^5%_WWv; zP1DN$aWAt``M(i$x0JT%9MEb$ERCL{$-b{ulds! z{oBlUCEp&$)Yj;v5y?j-y^lU3bE+-+R_vp&Hg3hY)^W8}s}dP4CbLtubY|$BZ8O93 z^!VAAUrP6$?$=($>T%wosQs&dOk2uwt(tD_9i57-*Yw@uM|PGzZhy6qvjweB41D(O zTQ_SXI#Jq>fvIdsee*dMN$d=#v`0F*_Jyyg8Xe6ih@?484gcK~-SLS40w=S8FZhYY z3++3*<%J1t6v=g?UHYCsCs#XC3ZHG>rzdlFi5&q15I_I{1Q0*~0R#|0009ILKmY** z5I_I{1Q0*~0R#|0009ILKmY**5I_I{1Q0*~0R#|0009ILKmY**5I_I{1Q0*~0R#|0 z009ILKmY**5I_I{1Q0*~0R#|0009ILKmY**5I_I{1Q0*~0R#|0009ILKmY**5I_I{ z1Q0*~0R#|0009ILKmY**5I_I{1Q0*~0R#|0009ILKmY**5I_I{1Q0*~0R#|0009IL zKmY**5I_I{1Q0*~0R#|0009ILKmY**5I_I{1Q0*~0R#|0009ILKmY**5I_I{1Q0*~ z0R#|0009ILKmY**5I_I{1Q0*~0R#|0009ILKmY**5I_I{1Q0*~0R#|0009ILKmY** V5I_I{1Q0*~0R#|00D*rb@GBIUkbnRH literal 0 HcmV?d00001 diff --git a/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4754.evtx.golden.json b/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4754.evtx.golden.json new file mode 100644 index 00000000000..daa5826eccd --- /dev/null +++ b/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4754.evtx.golden.json @@ -0,0 +1,63 @@ +[ + { + "@timestamp": "2019-10-22T11:34:33.783048Z", + "event": { + "action": "added-group-account", + "code": 4754, + "kind": "event", + "module": "security", + "provider": "Microsoft-Windows-Security-Auditing" + }, + "group": { + "domain": "WLBEAT", + "name": "Test_group3" + }, + "log": { + "level": "information" + }, + "message": "A security-enabled universal group was created.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-101361758-2486510592-3018839910-500\n\tAccount Name:\t\tAdministrator\n\tAccount Domain:\t\tWLBEAT\n\tLogon ID:\t\t0x4A727\n\nGroup:\n\tSecurity ID:\t\tS-1-5-21-101361758-2486510592-3018839910-1113\n\tGroup Name:\t\tTest_group3\n\tGroup Domain:\t\tWLBEAT\n\nAttributes:\n\tSAM Account Name:\tTest_group3\n\tSID History:\t\t-\n\nAdditional Information:\n\tPrivileges:\t\t-", + "process": { + "name": "null" + }, + "user": { + "domain": "WLBEAT", + "id": "S-1-5-21-101361758-2486510592-3018839910-500", + "name": "Administrator" + }, + "winlog": { + "api": "wineventlog", + "channel": "Security", + "computer_name": "WIN-41OB2LO92CR.wlbeat.local", + "event_data": { + "PrivilegeList": "-", + "SamAccountName": "Test_group3", + "SidHistory": "-", + "SubjectDomainName": "WLBEAT", + "SubjectLogonId": "0x4a727", + "SubjectUserName": "Administrator", + "SubjectUserSid": "S-1-5-21-101361758-2486510592-3018839910-500", + "TargetDomainName": "WLBEAT", + "TargetSid": "S-1-5-21-101361758-2486510592-3018839910-1113", + "TargetUserName": "Test_group3" + }, + "event_id": 4754, + "keywords": [ + "Audit Success" + ], + "logon": { + "id": "0x4a727" + }, + "opcode": "Info", + "process": { + "pid": 772, + "thread": { + "id": 1664 + } + }, + "provider_guid": "{54849625-5478-4994-a5ba-3e3b0328c30d}", + "provider_name": "Microsoft-Windows-Security-Auditing", + "record_id": 4676, + "task": "Security Group Management" + } + } +] \ No newline at end of file diff --git a/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4755.evtx b/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4755.evtx new file mode 100644 index 0000000000000000000000000000000000000000..4efe97cbf151c8bec09d965bf670c625892c6301 GIT binary patch literal 69632 zcmeHQ3w#vS^**!NEJ;W<39tA7go+}_TR;$bLwFbh8l-5eCX!H)JSa&d2&F+$uv!sB z#iEEPe^F3TK~X4(2tg1OG@?RPtXixOY{6=)zkm9j*?V?o!+>$xoo42@%Wt`}^E%)C z?sv~U_s+eOp@kDOCl?k_?T=6Gs6?t!98sE9`;`CqciL$+Z~VtMiQOQ^K#YMH12G0- z48$0SF%V-Q#z2gL7y~f|VhqF>_)!Li7ET;Isdx(d_@U3q(n>yzL4hs}iKc9=*%mt6 z{{L(z>*0GAoA1yfK=eZcqGRzyNBrg^L~Rm?`eGR3r+)VS$Tg3_CVyJMCV#$F=f9@* z^S-6nH?bC;{`mc!8YDTRmW?8HFTVCMwLJ>wX5yYN*18X$TnT|}MnuaqWWPXW%! z!*(a6ld)$SmEcziO~jd<@Vf;2JJWO=D@NLly5L`TY;~bt_`e`*zBJ;OPphdpjx_Pkb{)jF;T)r)+>N!a<^7 zkhH*frH6J+{WOfq^(%2Gl~Usd#?dI8c7rbP9GUHNAY+r^OGGs;)V%`@_q9n$0GcFQ`u;T9x zX|R48<0#aT2(7=wd6}82h9~_ki3Z}1WdP1 z_f7!AlN7f?KroRK;NgHU0!koHD87+iFMAPVVPT)?H=3EL&0krmHnF$fsM zNiXk|fa2z2D+lrr#YAV}jDYy-iCF=<9C>EzD&NV}IL;qTr`CRIgi|3+{R<_dK?~(F zftpeRrQ;~70Jiv>KuP*}`cC|piC<}yimyg_ajmh(*YhsEAwI1tv#UaW(~lyq#7#%3 zBdG4R9au;3!Hz2*`J4`@9Z$$pM`)rP$2o_5=CA0Sd*+U<7`u4H$`||fi92swN^KTG z?mF>-Hr4FZ`NP{ij@@?E(7!BfKjY#v-<*Z&!e^n>rec%ZS^f;UktHSWdWc>GdDzdM za41r4cUf7#EAhiSaRKqsbMOtY2aMN(x_g)gj0HF-)Qd;-rGRiQ#tYTG+8I}-MO--q zY_QYk{2EsSFJH}9F_JTls}m!x&cSv0ssqv#)q!21L`cW^ecReA#ToZAmlu|D$8dZ zmQ!>m5OPI@$TOEu7FgoO&X>~Qloq))W3R;Su^hI_OeK;Kx{~wACDOvM$gY@6VYsrw zu5|`%CE^M{DifMjRGnmen^R-`E5Et=`LJKUV}X@%UIWzJ^q0e>TmX@FL(R#8{}>8% zV+rjGf8v|szpGaz1*lDr#S;%4efA1Cqmvywt`V-yNB&r6AvUJzvSzgAySIH5x51~Q z{!icJI4P=@aQn(trQa@rolu4DJtJ*B$6r={3%lW?LVha^+qL}`lgyt%AeQ~saHJX3 z8YGX%7?}YcLZ1O_adCcic!wMqk4XPwRNvcV$Ei52iPQ-uKgCR$X;^m1$%~#-I8CIJC0SJ^m5dO&Uy^OcV{ORYN5FeN!BWE&tKFSnc*Dz zsR8Bq+ExVaQf5tVeq85Qs{1=u$O`A*#!f~53=oTrC`Ffgt~$^J+z-H4khzxsz}ALY7pSn7x3eeA8N2$;RvVA*4z}Rk zD!Sx|dJtFlQ2U8rTrONc(ojzpC{}t*>GqAC@~NAjU1{NG#iG=Y)hVNOKidU>7Xzyx zb8Y#U{p?f-ll|<8?Lwy$d|D2CS*Q)>zU5SGbKi=`Z@2?F9R4>Hi=E2v4#ag+QM8dg zn-l$|?hjc9qK7+`9==>S#9=*%MbX0&lOE6^mf!*dprH663_eN0< z_gVM{u_$^d4o3P1LFNfPx-UXR!d3QrxL^CrsTxD(t?^gA2%8q+7qo)U}c2F#e9{Rr% zsRu#k2|d)Oc2FN75r1%xD*rpyFNtFLTlJH~qLlw_?-}L4Dw#--d7}L5Yd=YU;4S{3 z679sjN)O*B9vETAAJ~tJ#G;iRD$zy=GS}+CIxa%5mwA`Cbcy0Wx9`T$&hjr76@YNU z?K9U$LFO_3>8^*&{NJbYy>Qx*Mb7ds7JbPSycCMaRY;isb@&Q0kMZ9=G@dQ`|AWf) zIZNB^c9ws!DE{ZBqmk{AAoCdinC@iO|5C+&@67&RILp6SQ~<(>=wFa|jDL)Yn)$z9 z<$K(OS-;+3qkm?<{S}L0;?)N8&;2t&=578TP`N(3uXwhz{EI~^{{3iw1(|pG=W&W< zD*JameB_N6qNabVaUroN{(r^!nm#`9A)Ya{0{?={wfskp3t?V_d0gm0sqN+MPk;G0 zKmB>K{c)i(WwH6iHQToShG^?BPOG(xQ!yq4-UXR!d3VFO5YLDFx%2}$U9R-d=;-%n zI;#h#0|yevWw{M_UrrH54uIy8@-9<0U*#iHn;c(|bl_78&0 z6MCpm)Mh+p{Ud3TQ}{@;5ezQPXwb&HP_i{k%M#~S|c z9rVitnQQqs$45MG^Jn~d&w;5W*Rff4tJg>A+7fpeA-sVcBqnwE?zqg|! z`+ig`Dgfbx>v1l=g3Pr#s*@l6Kb7w%?$~wqb{qX1`}~W=m;9}V1mICNeD&Zrp8*Z? zpO3E~^BDgoKg#`zM-~5#-tD<<*=#5KnPRc>nLYEC&BhF{O`KM1^D$+g$JYg!Yxy_( z(fazlk=M-}H}^AFDLov%Xw6P%^&l2S4?DIPdguU62(p+SqS()j&;$239#eYQf4%l< z^z>lW&lHQIhrB-;dSL$`$ULEk`qa-XHup0hSLJ{FvktrLl)wGCn^C&*XHC;(yz^+Uo49L zM^qX9uNB5w1ewS9Zy!1T;0eWl<*^oRmpjV8SX2PQ3G1KZ5kclL{!Q}_xS#x_%6G|k z7Y?w)f8EAetk%bhMbUrLcMbhB|ANf5{G0m+URxgv)%f-G)jW@gb@Y_d(Ty#4IjkeG zC^}kvFj7Z?ET$uUHQ@htysq{-YyG_dGG52&TBW17#*6NM#728iH-BU`?kg5WNAG_g zsUtz=86A0T+;^(zh~v7am5!d6@Xk#uZRp5;TqhRO@fHsVT3f4nHp%>N52+iyMp5Iydw{}GGAyQIRu zAoCdic%Pw}{})xZ`v&JuS>q`GVlfE_to*+q^BDigtC|0eivO}^qqjffDF0%y8D0&_ z{oh=Lg!SJlgGi8hjDNge%gp~KmFvgv&3@=vNBI|v3P3nv{^vF&5@a6ZA8$l6^Z!Sc z?`7TA?RA!au^1*^Z3zE@%wzm(jTV^s->h<7@sGQ{b(VjzcryM4naB7?cFp{6QQ1Ft zXx~Ze9Q8k9(Te|_&4>h<$M`>d%R=Fw*ZIAqvcKieiFZbif2(zsVzD;=$ymF?>vsg1 zYx$2{SBZ6W=5>`@Rkmw}-KI4R|GksCzi+#4&yTF$uOk-A`%k?sX+F{GBRQ?svcUNx z_zE)D@@{^fU0>(BMy#Xb`uMWa!=t4;6CL?(*Hh0Ai9EM%?}05b&o|z#%74h> zfeq}GzkPo!78QVSBJHyvb8Y!s`(xAlZg_sg4wY|zkIqf)@L#w3XEonXEK2>`c$HEA zh6D{{uI1nCkG(eEPyc&XGQWn?Dy5^-uWEN%^mJr3PfIL{j(X)8I{GF2xFGY4j=VNc zD?D$M+$7-)}-0! zFWcu|EVjftNyZB6g~XzO+ydt9|V~v^iZGr%Z<(b zk~E>aJIET)Gj>H(#Xzd{bb zAb;QJO{IrsGb_Jx)<1|v(ZeSRh91_U%@$-aJw#CtSFcJ6g!RDB3EonAIRC-DUq??5 zR?i8^e9U#gXkrY0Tl(8NYRzEY^aH*|7V z4`NaDa4;=W4}vVFhbZbH;_uIMyYY_FL(e0dI!8|rR&j?|6g@O*Waxq03qj@yJ$Nzh z2+vR8dFAga9i8*q#!@>vs@wRl)jWQ&n1(k?_<>@KLh=K~Iyzu+qabswjw0vr7gJaB zJpT7oZfCVBecKN2_TxRV*l6k__cg(D@t(6dt=8^O!Qa9`{S{=c<=qYAj`}=PiTC(< z*g>U-!mf|LA3Z%-JqHzwqKALf(t{xLgdXbCbI|bL&F1G3hgA6=nsdWpJLO+DKb(QT z2jZg<86z`bGV~cB7Ol#kpMwiB*OtHabI|ED!~7iRPl}F@3U9Qz(CaEL!ou4*Ux;kMUn@ zyx)rZ35Qkon>D%R>*(=s)h`o^wfWzKzCka<1A@%8{73f7@PNpa}1fo@VZs{aNYZneVq|M^6t{ z{W7sAdg%Uoq#gvBC-hJ+`(>f536kCrS@{E;~NPjz6&9FA$3gKse#{;p;d9nQQf6-7gqUCFZ#FQkLW%KA^hG?;a`w>jQ=v~DExCh_>1Cy;@pjw?sPOh5{u#w-~K4l9||(p^6!TD zNM9!{{*conN)Hzu|1`&0J%~lo!<8RL>Oqjj^bp18(%q3Mmhxba?jfoN(NCJKm)r$Xu%j>$n^Fl(>)6FI2wo`nXNp zZb$hSi&7uYJ-c0aT#Wm{g3M$57g3S$&*PI{D*h{G6!wcA|5oF{Vo~^?)HcL_6ZAQ| zK>vcwwfskp2V;J}j0g9^w4|>T?_c(Lf2+a!t>c#YZ&5E==k1T)zBy;p#DjhMzM9*L zy;dq#c@9h`KQ>3TYU%It6%f!JDP(vU(m;wX!?%+`VNiHh}U;a)OW;FQ$Ij4n1$G(n|u)) z!2qSlX-WE-NAxqX&1W+F7V!#xCN_c%C^b;T8z~GwbjD+H#$G;gg@gRocGF!euG8--_V2A za|5v`diYB%JqR*S=%GG6H^}31mvw?)>!nXLXTm?DSpHW17qKYiU$HyV9|$r}lz)Bg zzpy_DkBe{|_cx`7CO7Y{vf~fz_g}=~$@Cz|T&oA`{tNh*_?gqcEB^a8t8tirv6w&& z;PZ{=2HZXuVm^f+^EUs-6#s2bTafr#xc?||^pCfP_Vq6oH+1^l6U|>eHteaYtN(e; zg6Ug@e?jI={?S2W(fJ|19ADc?Y)%gM>v_EPIw_Zx4PGi7R;{lyO4k0{e^0<_yta+9 z*!CAq@(PCm<_u1&wRPxKY-ng8b8WeB+9C{+1=Hm&EV=<#ngJ|q^U9uK`fRF4mV z`{5`9LFQWid3uXE97TeIh{eHh#T=C@WD~jMh+rPkRwN?S% zyEHJ6xt4dc|E#ZZzTUXXa|%w2l^&YU>)zd2J%~lo!}WhO^w1od5M(huMDcm}m=5s8 zq6cpIOOzg3{`tZv>cMIpNGysT_SEtZg3J?os88cSJiM!q194n5Rh56+=UZH8#~;{_ zi^QS=5Kg##V1FRUTwDGpiHi!taS`+XYn5+pa*4zIi^c9l-5UeNoeGKYFUY*czwz9d zTp>xu+lb0>$-w|Z4<=qW&sh@^Wp2Q)XmWAX%E6+s9%`u(^7X9e-dyE)|P-qw%HVphSs7rF{@&t}XwQ#HA$>ap`o$|ECpw z?s1lXv8Vuq6X9Qwd5wP~E@k~!sC?i4|CPs_YF1vE69e-fIeHM!fKsb^1L6Et&{7=$9FrMc#|Fc!T-+O=2zO^>mXZ!q% zMX7&dIvDkj{jnhP82?y8A@LEXzg7Gn+LN^XX-D}Ni>vo+yy%N@Pmf%FXZ{u6%vtB$$mVa~qfae9a#5c6G3-6%B7B2&vjBreU z7ZrX@)|YqjA~0U!#Y@8qF=&>DUj^8@25XR}QxE*=iiKqQdVHFJBY3|l$hBHdX5SWJ zg%mGAGjL`BM>+QJA~yY#PrelMyucfkj@~*w`&~Oavfqx0#gpkskhxYz)^S844HZAi z&tGp+{NLa2(vPFZzt!_su~@quTZI^+6~_4mnQQrveEy0jZnAEa`_pq3@2j`n*kno;V#UYJj`Vh5+y+IVoDjQ3{>GS~8M_Mi22ULda!jd=cgv(m!@8_&sb zRu5uP^l;!+Ll48T{zQ<)^bpPQl~Odx=I5`sC_P+@)%4NRgVp$oSQI@Bt1|S!{y~s= zLJ#$Jd}W?0|8raBpJAu`?Z-u8Q2_`i+&;X6_*#&;w*0N*BGf;Li#VOH@_qD@0*Cn* zi(%r`2J_GUSde**|013Lcr8c+(S4apm!oTgm+jIhbZGMRH)c4q?kp*#*At5o4~hS) z_#o2%-6{oxw^i^bzA66G|L$j-9*ZX)IQr~y$Y&J#L6NWN=vb?7)DiEJsNIL_NICk; zJ_^xqn>PQ-uKgCR$X;^m1$%~#-I8CIJC0R0F2}t)`CSxv4}r(m Jo#}tS>fbarfr|hD literal 0 HcmV?d00001 diff --git a/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4755.evtx.golden.json b/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4755.evtx.golden.json new file mode 100644 index 00000000000..02cc1f19bfa --- /dev/null +++ b/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4755.evtx.golden.json @@ -0,0 +1,63 @@ +[ + { + "@timestamp": "2019-10-22T11:35:09.0701134Z", + "event": { + "action": "modified-group-account", + "code": 4755, + "kind": "event", + "module": "security", + "provider": "Microsoft-Windows-Security-Auditing" + }, + "group": { + "domain": "WLBEAT", + "name": "Test_group3v2" + }, + "log": { + "level": "information" + }, + "message": "A security-enabled universal group was changed.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-101361758-2486510592-3018839910-500\n\tAccount Name:\t\tAdministrator\n\tAccount Domain:\t\tWLBEAT\n\tLogon ID:\t\t0x4A727\n\nGroup:\n\tSecurity ID:\t\tS-1-5-21-101361758-2486510592-3018839910-1113\n\tGroup Name:\t\tTest_group3v2\n\tGroup Domain:\t\tWLBEAT\n\nChanged Attributes:\n\tSAM Account Name:\t-\n\tSID History:\t\t-\n\nAdditional Information:\n\tPrivileges:\t\t-", + "process": { + "name": "null" + }, + "user": { + "domain": "WLBEAT", + "id": "S-1-5-21-101361758-2486510592-3018839910-500", + "name": "Administrator" + }, + "winlog": { + "api": "wineventlog", + "channel": "Security", + "computer_name": "WIN-41OB2LO92CR.wlbeat.local", + "event_data": { + "PrivilegeList": "-", + "SamAccountName": "-", + "SidHistory": "-", + "SubjectDomainName": "WLBEAT", + "SubjectLogonId": "0x4a727", + "SubjectUserName": "Administrator", + "SubjectUserSid": "S-1-5-21-101361758-2486510592-3018839910-500", + "TargetDomainName": "WLBEAT", + "TargetSid": "S-1-5-21-101361758-2486510592-3018839910-1113", + "TargetUserName": "Test_group3v2" + }, + "event_id": 4755, + "keywords": [ + "Audit Success" + ], + "logon": { + "id": "0x4a727" + }, + "opcode": "Info", + "process": { + "pid": 772, + "thread": { + "id": 1664 + } + }, + "provider_guid": "{54849625-5478-4994-a5ba-3e3b0328c30d}", + "provider_name": "Microsoft-Windows-Security-Auditing", + "record_id": 4685, + "task": "Security Group Management" + } + } +] \ No newline at end of file diff --git a/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4756.evtx b/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4756.evtx new file mode 100644 index 0000000000000000000000000000000000000000..eb53aad92c81cd2722ab1e4f4e45ffe27a52997c GIT binary patch literal 69632 zcmeHQ3wRXO+5Tp;S(1=!!Zlt1p`r+K7Z6155H5y*1S#68M3NLF7n+L%p)@E8Rw{x~ zu_z*yUldeSP!tLxLJ$N6ji^u*s}}18ELio|=geZl2AVotd5Q zJ@0wXcfNDxoY`S{xoK1La;WCZqjr=d)hLE2MXPzrzx_Gotm-%a?TbV&5M?0BK$L+f z15pN|3`7}-G7x1T%0QHXC<9Rjq73{b1H{Q~lPj+Y zoNfO<+gW(B*+=FpwDb}E*nsF{EYUHq`3OUOp zSNnP2GVIH(foA|df2RgX&Z%J|UtNp8`?%U3jdRm*&6jFihtK&>y{f=nZLbRz)|$sV zbU>NL^B7Oyl~LLEmDd+kX~~*KiP{|#mV4!!y#3KTw`Fe5J=C|~Ym-{9Lr(atL5=89 zY;p$q^-^Li4WpYVhYF|!pXcN4yHOq7oE%GKluvm$Sd0U)T2GpS(@JPMT}EB-S4@+! zCkN+bVY@TZsn}CQh4@rRxj3^kJ{Mwt7n*@%1xUM7SN!$BR#)nc|2aYP#UY+53F@?|V5$JeJpP8{^`eYh;e$v# zdtWT2<3uj2JpCl%lRVS{A6h7#4x8nr@p@TI(@*iRL5*7D16KilJ=MxbV^DxxEKCub z)A&lU)D|D4=G^#399@CKGf{4Z;4vG#^Qp1a%nRDb;=^Kf#lCkngwd%wr$caR4ghcw zW#b&39j0&5Mv=7oD;G#1Gkw-V+3tY;bv0VrnS@B#J zgMmSu^oq`LC~hvcQXmgdOmrU3@QJ_9P504N$TM44`A(!JF=-%v6d zv_LN7s2RmkBOFB)z!tybC_z6@--&-|_>@A)cxzM{(*}Dyy(;*Ec(pD+vGV99_M2W5 zaXBuUu8yF(*K}Z=zy~|7Y~*tWpmsVfPo1ENQXJnX3y6=l#M{RnFcwv8G|0}^%daTt2|Y<5nv1W!y2iQ2H{wIS zk%=5;lP5`|CVc)S>ii3g^ZmL5Dgp~RFfWBGKG&1v30S&ReUmLJY$+k%916a%Jpz?q3syMb=h6>1=rZ^j0`*;C=v9a(_GWGKMun+8f>0A(Nb-HVMp zHmdPm>s&SneBYAYP}}KX={I;6p!#sRplWcrbW@hkH!LUVZYJRD@{ngPpLDRx&8a6T z9u~c*LTJZOVOmfVItOW@+BSdY%7-$9FUX*NP<}Q_iOVQ(r6OH)?4~=aGeiN!*fSLS z`i1xp*=KkWv_t%gZH9l>txoV!+nyD<2ai8@N+allU1SMe5A+;ll)`ykg6hy6bu=BG zY8dd0r`oP?HQZip$N1{C=f!;Wc8}pQcy;1`<*SRo<#;Smq5I5C*}(CamEXc{_^5#2 zO2Kwbzr_^uYcQx~zcm7BDzyRCBU4AE0$t!WkS$hZR|R*-fr*IpFGn@LQ+Avwr*-ji zBT=p#B^7~jR!xrX`8e3i!(Y*YYr6GcvNB`o9hdAKK7MODr!dGV} z6=7G^JLg3NFZz0`m*J?+Ygs(Vp6_Hg_=0#q(kxtzQBkj}=>V~MKJI*LWpp}DtGeItUj+)&C`?jb? zOWhehAqzgD05+!Rg3&*-eppAWr#~tkO&XFAe=kb$=jzCQJr;{rI!Z)67G#dqk##*r zy_R~s0{q{l_@6&D>%;Kz-$$>G&RhOWv)bOOB`qb9E22YWT$E!u2Bs^<-cPSOuA5%g5|zr$dJ@Ry=;g z9mo;zzkvwpOn!F|zBe638``ru-CyedkaZw>xLfJr%f&+@tOv0udRS`G!#qS_f-I_s zFzSIzUlTpB+gz;lFk#aDVbsF|7XCpjiXIC5q5eUTxk3-wKf^x+M!&e@Ux4?S-b3<7>u9F z&`#f@a(yDHGUooU#jnX0@sn6A|K|h!N}-4a-@GvKOQ1 ztMo8!=Y476(}PtzC>BKz1KthQgCKK-9_mv&sE?3{Ke$ho|6LoFhOzvu`blC@%Ky&y zjq+ceNF>NyQU3L{pQPXL7JpEVcH(}ehach(jy`3dJ@ThB@{79 zAz}X4<1NTs#(#&vc(&;OPb$|JENj0fviyrh@jtg74{eVGnalXcbSJa^mnr`Hqz(8Y zviyrh1t6G+{so!K_{W&2ng0h>z9&qc{o9Q;`e*jrU$Gb@UTrY{+&>d!?&kj?mFwgC z3+6lPm!wU{p;7RCQ1k2n0^yXcn*GRN|7j*ocW<}dKJKbP{%^9I5_Z!@rns|0hI zcwT9qE}9(kyv`+ig`DgeQR>+vMK1({=YR3|_BKPul(-nIMu9X9$o z_W2i!FMHbz^}(ZT{OaLvJ_8!&KO1jB<}&_Gew6zak175ezt?N~@;Q<0XNtx0XZOxu zJ_j?vHgj5~Ex?q09$yz^j^*F%N9*hTMtwbuxu3aO>EY;QYj;If4`NaDuyd=ShmO#M zAdBiDjQz|IJ#c^Haixa?H)*ehPY+i8OtC0>$oh++2lfww%oTd5PyNgSb3gM5RsN?w z>$uxa`P*-w#bRycFUTBQ{?_qPjrj*_6#spOAKepK{>5TnEb%t?Go^hNWG>^M4nHIP zOitG-{`Vi7UH!0)_{hHg#iHncWToN%T4S6=khzTi4x#f8o>csopKRG~MMU`*iwZz6 zVf}MFBFJ3EziIvf_miJe`7ZqK(t&pPuiH3_)%sYmDEe>qo}qu{UywPLe{=u9ZR=y9 z8n3>-n&%O*j-FOJx~0|b2FCMH@7}t~hK}sVbz-p* zp5g&P>&s^u49684n;OU*t0U`v4W7?oj;o(l{O=yT>fXrmFBTPm)A$!;F5@51y)pCu zoXURJBj1r{G+y;`CqTHJ$lS}jUS7s{}GGAyQI>u7i8|{e}l^Q zvenBzi!A?QQFxb>`JWB{FUZ`@|MM!_`v*Slc|4-}4_YKVsthP5DJ0^51eweDM_h0A zKQE|UcOA4lJ+l0ZMFk)@e?{~!$Xv!hp8II#f1}F&y*oE4*c!ZvasQ(d*!n>rxzaVoN|9GCEng5qmw)^?#O5Sf5Lo$tLFO|4 zkykVSn-u>g&ByF`HlqBC#pZZODEEISDI~1_)~Q5-%w_!J`C4ZFH>+Gfaeu}m&qb7f zv8Vt96Xt(jGa^CeGXC*IG&BEyQTblpef_@3@-G&H#H$VAUy!+sf35K%GyhvuuFL*) z&$p4~Uo6(fzaVoN|H!VH|E((f7Y^$;Wqm~bk65(ge^+xNLFO|4kKVpm_~&(gFRSct z{agIq;p5+GU8Pv8$$ui&?(q5@LFQQgL)TSe9i4eyfv{44THaTQupU=*X{n1 z)$?`4V(EbCcP1<#dSeu)Ra!bYe-v*)=2+g%_p|HkeAke5bX*@_QF?f+cvp-aJ=nhw zBo>ExXgHQM2k&gM9wy=~$Q-K&>-#{abyPg>c)Q|%{^8GU@o&FAibbi97mqdS<3!B= z7i5m*-wE|mfBwJBKj-e?t4a@jIwX1R)W^E%!D_y-SQI_vryF`;|18K{p@(d$`*Wg0 zpY3|)`5~d_*6lg4h35IjJ5>1(tr*n6PWjvS$6`?d2qw}#3o^%+zqLO$J@1C+N93)(K;~Hf&HmVJ^ZoSSvy%BWoK`9woqcWlv%;q% zt9e>tQFPQh%h1uU;l~A;Yjotcd0N4Fqa2^_QaakUBBPZZ9ocUW#A2`^P#fGHus;%H zj@6NMdw^WZI0dJ#sa#Ji9lSQhMt|8p|6;KfW)j1p1n(0_|45LzjQ=$ChhzryAj4KjvwH(N?QT#zl#2mAagAL=JvS0j#to-0q-SC z|A^B)N)HDcOhN zEEYu%e|XE#1N#R-<_bO3r~YyibANfSD*roo%zwd-Kd|3Ei$$yQ-wb66GRKy`b$m2x z>s)D{Io+rD|I^sGi8eYxgB~_<$K=Nlb_q+-+p{57RCQ8`aZP%5oC_#-wE+) zF`iSJDe(xW`;{Il?wI{$Wc45xMGxm`p9cFY#}JPQvZx-y7@x8phM4tmKA~tgfmjqh{5c_14}#1UdT`@&JPYN16Z@AcrK9Ny zr#d#Z(GRd6hl)kf(E-1qBkqR@GFRxRzK)afZ&eqX+nINi9v)l1vr}aCAQnXrN0SXb zaKBKHMfDKIcIGra98`L^Zu`xhBdZ6oD0(=Q5~>G57S%%-^$_y=^W1K{tMt(8*yb+b z(}PvqAr?gsjT;+!;Pyh0xk3+aj5~t!6L?Pb@Z`{^$cuabLXGY)-4R z2b1tyIHu_NKrgVlXdu_$`@R}DP~GFRxKKHUcm z{%$tkk2tK#|M1+KkJ>5!y7}Q${2qvhMy8HRg~`Bcpjfmjf4&bc$Q)b#*7reY&`k4v zpuZ|QKFYhr7XSABu~-!TyUsQI@kaP$LFQQgo#2o0bQ7ch&AK?E^zg^*v@e?37>}`E zAH|{q5KN?f7G#dqgLQp0&EseOKT!Fu+_LhD)QIvg7K6mA4d$Qgqabq`|A@iGA9DJk z%JuMepKpjP|6zvAzftdm;FuY;n^RyWrR-;R{b)uD0=AeMyMVHnJe^AFZ*SzgO64DZ~fm_!dU)R z>lehLl>bxvjq=ZqH;}oa{Ojv|Ir5>uEdGGwqED0__KrI>){Z~0-!Bl03P3R7_TfZ~ zfy}Xbu%5$Ck>y`3K0x#Ugb;l0r|>VxT*iM1brSx$9{gSLpF3~U zmAfJuABjcrhwpq8>JJ5(WBGSNe59|F7Jta;F{OvgPJNmgSv`nF(Ze+#hw4F)MfDKI z`_kR1gvvw@d|&!ArHA*6*G~wa9<1(5i$&4HhEGEEAjn*y2Up*hW8Ra^%);>L z$SUp@i=v~!$3k@^$XubLdK-67Livkd;rQcorH4KbE==ETBkr&tcZ)>@AeeC6w-C=# z5M++kgLT}Ed`jHM=@%;B_k7$oW=}-<7mHFKFFe0}a9oW0!Gg?X{O41?@XzCuUn>5~ zX6E$|AOBY4!D3PPpVBVCe^c~1yF&kh%(483jt66Yzl;a>#ex&0Z@Rt2_raA}=;a<6Vr4_-@2Ttk#pJAY>}RuQpwV zC;E56p~={jL-~}2?aoN2Vowq26F?~!XLiQtLhSECGjOZ`X?LuZ?Mgkc)s=eVe-7cH zgg8=yE0{ldwCd{F(9U={&DeJ)^}gHmgZG_4;t{C?7W6L}+cwYSq<)anUs15v#SJU(!g*piZE+8;zmC zAUYjsAEZNQ913Cv<JQT}hZ0C{WV-YT-=i^yy_!Fr~jMv|Y+IV%wK>+a^ z%&0eE=36to8&L|`zi%MQ?Dt}P#va@^7_f`eDy<@pXbSif1v|EWI-y^jM~T{G_7}WP z48=>wk??E6!}DJ~-EXky{}Xz!x^EyBMGt?kp$9?c3O&@P`vzHD?y^qsgkJhYb0>cv z#`3r7zlcRC|FS)y{y>nqqWtS?|AqZQa9o7rxUZESn%=gj(vCl{-+vK{wdp~SIaUwW z{TJ{r@iV9YRQwNUUL9fn#bO*afX_GX8*uxahxrtO%-#H-RQ$I+Yf=2`!TzJf(LdcD z+Sk8W+}QaKPqujNd*YkMojZ!YF z8oZo0yh>kZl&Jlue^0<_ytb{f*zQ+Nv+{-m=1fkjwDss!Y;0&Cb8NYA+&CT`w=JuLFQQgd3`|E#ZZzTUXXeF{zslpb2l@6jW&dJv1E zhnxOl=%EEPA;_Y72;=?mu^r)yMGxHa7b-op`rD;p)PvPHkXRHw?5*J+1eq)JP@l$u zcz9PI2jaMBx+?#6FSNYWjz6#;7l}m$AeeCb!2UpxIkx<3iHmZAaS`+XTa|BZYGH)= z7mGcJdNcuwyA=}QUy!+tf8)L}$E8Io*V{k*YQqUfP=uAzrVp$S12)k7HL(kv9eNA$q)NvYDqkCQG9 zqaLi{Qn4s{DEqyk2lfww%oTd5PjPAR{v^jmH>vV}aZA+_JO03aTq+jvMB^(bK#3BE zO8X$l99#ai#HEEHap?@j|EFbr?~5$|Vo?DICc?iUa~uCgT*~?{Q~6%_f8{45%fDEh zcL6=Z`k$nbF#kNKPLR2c|Kbq+&s4d7tLW{FwKn2Y`~F8PO8axs^3e82khzTi`&Rs# zbuaT%ZdUw1v43sF(>D0GKW;4+*EM@N^(piZ@>_FSrEP}(JEC7E$Q;YR6Z!{q_b0|U zCC7!clpg-Kjelum^&l2S4qSU{!9gX_O{#cN?jDIYlkobtx-z)wP?@ie8Ohow? zi);37y6lSy&x~4eclOoa%wP2j*8j(N3o@7S55CR(mn;6C*8cJ0a}niVEH=Ta4FpEP z{+aME$lS|6&+D42_^+PVev2Lc>()Q`E1pN{rT(e?P0u40i{gKF+-&$C*1sTgEdS>I z0nZC;g?C_S7oI_hEnWsT72%lvEGm4OsxR;2MPR(dia#(Q>j zWWOB~i?!)UkU3UI)^S8U4HG}g_g`;S{6E{fQup>LHxtE5&G%&G%n#S9-Vs ztLek12dnWFu_$^NUTNro{evKLg&ykd_{w}${uj2&KF3b^+mDOHq5=?1xP5pR@wFgx zZ24QqMW}xg7je2k<@@**IT7YxECz{J8_YlZV?pLN{_}PIV>LewLic4lU4^a<9=1!P z(V@xKpO_Jub!Q1ly`QW=JS6_F?1NDMcZU=Vo>sxH*k<^r|L$koo)x(Vk3V+`@)?bO zQ0QYiI@RbKb;7eGYWCqeQKtT|k396-iWXect^bmh8B6cDWbg3tTeItO#qr9S+13s$ZE{^@sS@7b9R1IB50nwj4&zva%(&d&Mn zcfWh?xv$Bfg8Yn$1$k8c6 z|7_=#woMAncW4?Q`l$}lv3Q~*e)Bg(Efa`(VHo0+netoB|e_fsD zbBl2<#$`diHv4T=Uh)318K(9zBXf z&LF>DN{**NbR*?a5tZTd9J~WJs4q99##1>JQUSg!#TW5fSDJv!%4jlOOdasAl*Z#s z9-UrB zGTb5ulubnTC+ZNGx}cu|zF-^${90W)8z)5RrzO^*G3v63V5$h;`GR%H??)Lo!v~Rg z?w)wc#D!c|1^PwA7x}0OJ~UA}9W>ofqxG_wq+jA=gBmr*2d)DAda7A~MxX$>SePO< zr}3TQsU<#0&AH)?1iBPoPeZvCgU4L(&X>khBR^;#i4XJD9edtY7e*)QoDRUHc>usg zl#6S0dbk#`rY@PD6j6fmBhV9|dU0A3)MEIOjJOmN+oNzphRjGp%=>~#l*CwW#gD`x zEc-`Y8lYdsI0|$mLhIGIE+a$L@T6~&s2}cF2H>ogGUPOL-(Vd|4X{(-V(+@O9Dh*X>@uAzsZZuG`u3751Bc z6mbP^nx(!$b+7Kg+JO&tT)D{SR6uQaLY~?|6I1X#=a8@bHJy9k?9t_;7Y<$iQtzH| z=Wj`=&O*pt_Z-zAUK#;De){vuYcjt%*yM*zhyGrI>cUr{)ber2?JU0r-prB`cRf%q zf*hP@PuL47x4W#Y-xvGgow$Jb+opI2*aOC+iVX+Zg?jmwggv1z1w?c4wO02y)A&VV z#4oau!(8&EXw-nOzffI&u5o=(cR(dzArI!IaK-2PQhXsx7pY&eMTIRb;+F%#H#aNH zsPXH#Q{ZIBCw2v={}ed0QEJ!I4Z1=Nr1H!7&@a0xoVp_mahM7PSpCvK83>{5p?-UT zk;i(~eruh}I-%cNvKwhT6D<82?;=zmE*De{E|*Tq@;Qd(6y42)oLvF(%;l2_cDXtA zr6j_lA5{qL7%EH?YCvZoO;*R|&s_OXhVTVh)C3|! z6P{`i@QkLD-Qh~Oy_0>%cRzVv%y)0~7;b}CJN~a?Md^1OkA*69k7;RZIsUTpTR06L z74lnYIIixum|}kQ2es_Ch9FI+7NB})`ml7M3%&ZX#f7<*;S=)3SVa1lpc>yHCr*{q zns~XPC|8b>O29a)CQtW#9PAa~U&-97I`v+#ENjv27w#TBdQ)yq?l@X`(#xUM4tfm2 zcV{ORYN5FeN!H5m%w5m`nc*DzsSaiPT2&BLb)yQL;rMq5sJv6FN?q}(6QYvNxS||^Rvykx1G(%us&^Oc z+oEbMb$j@P9QcSL*qERTM*qzEVI8ra{-AU;Za`Avy(qixwkhxYz z*7X?mTI%sq@PC)$f6m0552MF_54|2wfY{in=&!zFu|B2fQXi+jXbA56;w{Kr%YR^V z-OLMBSj)#*<7bUt`BwAwM|TCA@@W-aazx#qt9z(b!zV5mt{-WrC-W35T_<(^)=v4< z%+D^j@Uvo3>c`5I5xSr42*3-0Rgk&1e9V4!GK9%~_QZCf{RuuT8@?>m26NwXGLE@# z#p5^JfgA$=8;X!l<#+qxcau@Hkv*Fe{iW^?SqGwryOkckoIlWEJ%~lo!y=O&W+MU< zWHCKNQ4d`Dn&^Su=6t1xG2`x!q8=Ww@DE~9^iULx^bdl}6MD$~1^yv4`o$gpBD_x> ze??x)arw{tgmzr+5?esk=*I%b>kGnr=@oTC@{3I4D{_#MsDNw}RZ(kVuCD5cHc3J~}EXZ8Tzd3$_ z;E9-TX$Kc7-k%@lANaft-tEUlVzKcas{ed0W`p)~TB(&K5xolD1(|DkcSBr6)6>^o zV{QlUReG4T?Y@lY>A|WU6pNyVKJP~AL6CVu54EWs)JI6fAKa(P|E{%*qFDY`{Uos{ z<$uTfM)|KuCK6~>XN&&-sB(So;?}#I7paKsXWo3o?)Kk1ECKxNGyu~Uv`0}k57DvIi}{| zUy!+$|HyG6tcx&@3q35geM+0tU-|7XpHH?wE>xy0Ho2r~%jVw_Z63^NrFKaw#)QDT zAagD6ZWtHh^^jLcKakU55qjWxlSh;u zR?KVLBzk(V8YdKsqKBd(h91~I2r^ITp*D>ZjyKPjEmP&c{STX)*(rbfaj95T0Ky5k z59|*FnQP16dRz$Yv$*i2WBfz>!auLOdsOlN z{+sdTcKEMZe011iy?|I0|Cc)2@PF^3Una<0%fC53;&q#6<86N}<*C;VM0?$4XcJc% z)-v(B(gIyHdFFMS%ax9@^PBx>M@RPks9010!U@;oad-wKfWAI99zT%q)E_~KPNoYjL^6g_O)WayzS zG$F`hdWd2_GeQsC-*{Za+ZIw*b`g4&HYSip9Pu6_@{%< zNI#R)Rf_+;M`lz#Y$HChuYa*9`X9R8@PExQ&LYS>#($g0^#@NX{wt0(ZMD=<{>7pK z5KdVC9FGVxkMVC>f583Zr&PX+zrU!j9sX-J&SJGcRxFDC8@*@fpZOPLuI1m{Kk(ZA zSg6LY@2}={M69Eym5y$1w$ou9iAB-T!UK^y5@azQ>AL~{x8rry_gU-D1(5MNPFE`( z#Wh&);G;I$gPQpxt8rhkC^|ayd8Cd6nP+t5wQ=9cq9cy$o>4k_a{RluEVrQ}`*EFE ztcRy~K+yX3Sq8&##kz(DGS}+Jx?h9mbC~1mXBGcD`!B!OS^mYM0&oKVg3M$5`Hvel? zwimBh{F$@-i$&pGQs#dK{J$XcHviA7Z13&+wC{08^&hrKcvKlsj8jO&{|GXV@sGIP z?0;TRx$f9+XQs3Ki$w(>ynaRWFUUN`Kc4$&=6{{a{=M7QZFH7@u_*jYD*6{>9^)Sm ziZk>7qRRH$FFZm|IO>1IqVO)M@Grgm zi$w(>oG|~h8xaXIkMWNuqM7;sv'&TIBK%fDC*6R!@0e?jIk{NOYzgRpO|ANe8{3E+&{x_-YpEs!2gf))(AF*h~|Bl8)g3M$5AHHqA@X!1FURK%P z^w-3@qsPD1zDluJo&RL)-QoQ^g3Pu2NA9b{K05Qh%FQaW2T`NzI?PU95e!%dayqa zBo+txXfU=khi5if4`cBbWUkeN^*oSi9~G}V-lF)QbMSLp{M)aOVo~bj1tX36I2P;w z1(|F4cSC*DpZ_oG&$&DJs?tM`HYt8P^|5Apuv%{{7DW$*nT8(NKMOKX=pmPC{+#H@ zXS<$yeMscBHG2+hv3b4mR#pB37xt@Tr~K{vW3i|JgcE6>1(|Eh-`XFWo_E9RBeto0 z`@42%WQYHn)jzBCeqvGT-}-Be`Zq9WAagDMW`FFp^?v%_vy$~SoNiY-I{li~r$tXk zR_nCHqUfl5j-jKg;l~A;XLRJXbz0$dqa2^_P&(SYG^?2%9ocUW#A3K1PzT%|us;%H zuGNusdw^WZI0dJ#sa%hp(tlN&jsCKI{>5T5tR#j*3C|Nq|45K|jQ=$rfmBpw;skTj_%{MQdZin7f`JTP$*yncmw;!L1Me#rLeu!*;1et63cSC$y ziszJOOFY8qUZsbHx6k;}Sv`nF(ZgBVr{Vs}5yT^cET)Gj#;2@@0cJhyQ+l|2`cjAW zAQnXr)8iubAjo2Rh@u`)`uHp4@C)+yjowmvXgs~*D`)+KSQI^cl3?gzHQH=J7Slr% z^>FQqq(E2?JWuep(!&K0@A*1o_U@t?FWPJM)gx!(&UfwR2VvVo~&PIMvVt z_X`DCOb=0PXHL+=ex-+Nx7^g;Sv`nF(ZhkXNIeL$m>#02hlsyF&+W#$N)O$RZ0Ha@ zJy^vZVo~%^zrLXdZZ8CxC-mUOxFftif!CG4r*w4g>+4JH=%{AnzgFw`#bO$sEa3-= zkqXIA80%<@&5eT0wK|Gi$6rL9%)M#Ngr&IsH)O zdT^`H*E-9;ShV7Q4fq#i9^=2rc)k_)6Ar8FH*R>_*U{tOs$V7+tMk7BeS_|Z2LzdG z`H$?EVS>-xFZ)PkyL98eOSjwbJNDxMu{dVy`RUuyFDu!@X{FW|ec_+bLl9)H<=qW& zKp~zXU1IK+{Z;AV*&jD&MNbb_{W7sAdg$^-q#gvBC-hJ&`(>>)e^lCcoN-Y;DaX0cQaUZ8&sC?h^am%<}j`A-Sr9Pf_PV4Zv825t(naB7qq(b4J$0xs3{FhHF z=p8-&t;U1JqVPYVRfzwF=yP_2{soz9`HvhA#`=C45AKd-Nna`6zwCKvv%&lAW0v@D zQx96_-K_N=RP-O8L05Jw6xXd5{r zfyMlVp8~#M90mMZU4p}-JviwL)+N6mH|7)H=_lY`{hCid(FCmdfP4aej=V4`2mW-%*P4cKM86Wpd?mwg8n57I;2>CsQUis2kizgo zS3E9P?BOpGC?Rl+4-zRMPD|5o+BCob(@67cRaO0Q(+oZluQj17Xeeb-J5bw+Mo@nc zor$yu(g8FI1u>Nh=z36{qZdm7ie)^G3rO-Y4>!{D@hlF4$ z@zPNw{2KG{oL5iu8!Y<&h90cu4aB18;cwOSAjmwShuSo6ki+FJ`vkw%OP^@g_#dKJ z{#N}Lu_)zVzAMrn2r^HUe{Jo*us;Zoi*OwGjnYHITX$`@;}7ijU&P|c^dQJws|V}; z3;37#nbUtL{`)kpa+rUym_T*l^No1}Zl4RVolnyf%e&cs*48**Z(L=bg3}_UhbD8nba7S>Vo~&P zJMV*Y=l@~urQc9?&$ z*oCM|1E9EDArbxsnb-I?=8ZWnEm67N^5JKLqo;qXxKu2Th@(u*QPEO`BpK5|=VPQ^ zkhzxsYH?{^L|n>Kj{JJ4`S?3mIvSUX#Sf-T8MP8|>8_caR%!#eF95$I$Xv_28{$$w z4Wt~2LpUu9$$^%ipEl1~J%~lo!}eK*9v+1z1X)ZEQH)D-Q2aj81IH&*lpcN>cTp7e zU=^2&MbSg~?+iV#e-LDz&_ivCOT+V%92ecF%KycUl?&|n1N(8QSi}>JFB=0TN*pTf zgCKKl`JW^%Eslswrz-wGE$?}sv;2!i1t6RV|ANeG{2Os8>%Uy(`_BKbIOZ(>VsZAl z^a$&JoI=9<^O`zA<~9CHBlJH_<@&9Xx3gB+h)?bNAF(Ly&-qIt+aE#ZG5+scdNu1_ z)~DR0_7bdWOOEvf&KPbEGhuuMA`>I=GyWW4r~K$M^@|X8tP_|4(awfAKj-`4@`~uxkT>QMi95 z{0lPg^3UtKW-0!wX1CsGhyR-O5B`GZk@~53dT-P7NX4S~pRG3;{)hE1$Xv_6xqrax z0-NC-+S-L@P~wQUflWj>ray}cpC;gRK6S!I zGJQWjO~W^MzA4DH+D>NQ7GZ}JZ$UF~W&+0)oZ(Gu`YV@wDdu&7H!B^zeR|e=c64OF z9TSTu(~%%^t&XhYh(sDBew625Z&Ca|*!!}NqsPD1{Hs{3-j1z64AC6p{DRE2{725e zV#ZDOjdFi_w&H!|mYW+c$c@&zYODP}VsY)dtQPZgiI#2Sv{D-j&Xe){OhM*a-p&5A zwyq209ikEQueT~aJhcAYbZ7M-7DW&HUo-SD1p7|}SxgVn9A7C#lWd-Uy-n%idhDi; zo*t~mSHz;|VeocC59}WVnJ4s6YsXjSsPaFrS?(Ej%HMumBo-BbaKi1wyNIs^nQP16 zIxa%}lemb}xhmgBFU@n9f3X-QUL7$1?2iSR*Z42g`H$Cv)DPX4$#gloHh9=B4M&G2 zSASxLGyBexQo2965b==szw!?v{on0UFnC%8zv3I=KmG51w(PnvfB(_vjzd1f(GQAz zOh>zFeWP}GmPGYFTsz9vANEmzep|`ht2*^wuq7YdC)v02&F+$pjr_` z#iEE*t|+LepiwADk+-0r5f!Rp)k1w>3s!se-rRqk*=y!ZIB0s>IXCBgGkn87b6)G; z|Ni&dYwxr7$%w*&^eKh;RQKaiJF1Xs6hoAv)jj3k{+)78?Hm90O`eB&Kj`-r}8M06^a=(yK-gs5E{(EtoX{Hvb>KXT0zu*sj+u*siq)cLQe z{k(5E_7&8@GYG%GRf8nw)v-~e?#0(Wp|;21+;rUYW&T~6KbuZ$*PPd?7c#dcSu zQ?RF$O7N?M3UFpu{4T-%ZZreOijnrD?)cXWTivNI{?8AZFAMwS(Q0c?qpYOdO2+#r zn`Yw9<+?=(d`NBWwZJ7M`nOqeG)}jEGi>GItWq59gKxTs@yh$Wlm)OwI7sC8ljfVK z^w6<|molhAzY>R%DLH0H42{8Qx2Q9|&TV8MYZMK~u@3n9SaN)uj_)PVRk%eiD4T-p zPthSTb$&1TJpLH+d9}v$6YLPBpA+ARCaBY~}^Y|N+*NZZ4gC8RCyaTb6i4(c3 z3iXqSPx4SJ{Ai_gI%1ZW#_MG4Hi9X0&pT1T>s)Yov0#6fx!jp ziYHcUMLz|EEb4+P+5<`%iVB;Fv>(!8;G!!8QAju80xspQ*e(H$tavVqp}-(cdS%x* z6gL-J1&{|QCb|G;_{3iqWcuhDIkZP zT?f_$e6ZunLq2B!YL_$e)CHQTz;VtYpZN=FfB(GkmE)I=TK)3C{xKJCPpZp8z+F%H z_5vR}dUn~oJ^!tqH!Q4}yn9>u$f+sV$7i9`yx8P+mOsO9Wl4#<90kNHRlo{J?TDI`g{Tbu8=GCWujaN198nD()Z>!inu$Tj$oPABAR(V(6 zl4gx{L&V$Lwq#xV#FdLO{->tTTJ}P!_HgSz6bQJ6ur8<8)#V7>o0%%r-66M#Tnie3 zZ)6y*r4eO&I#glv9sK6_s|x9z_|2cHHD%u{&6D`6-^`SaT$#=M7Ivcm1AZ$7+jadG z7bt&*!Yuo(kw{aiEeds1>gZI4qJIX9McES}{SGwwlfO)7-X z;rN4455`xJIhKFlw#J#4s<4)~vnI_QzxK_vO(*yHTk~$! zK5|5@w~v7~8^5?*xO_MSU8Gp)J+0^0R?4S-es;BqpB0NzKh`FV)%|RD0A32Lg3Phy zWAwArAx!qOXST~-&+uv4@MVEEnERH~vCVxe9>3uZYVZes>72n~tIl@7bK` zFZFRH)`95Z9;Jsb77w>s4`NaDu*{%`dGSPoEUJeH>VZpN6FsooT&(mkA?JYz>fu2X z{~#7c55@j){~*X*p@+PG!9N5>zqsRHjPDP}U*YF+f9uD6LKiM~iJz9J@_%mYSKnG` zAFTI-#NzpS#}_>@g@oIOM6?fr%(3Nf9zSV=gYi=(+Ua{$uD?p!74tyE;@4!8_(?2Q z{r$lK6;Q;2uV0+_1<<4*cG>`cEXW+ozcGG-;E9-TX$O}o-d`B)9sYs^-mS+)VzK1` zYWhMR(Xzvw)@bDkM6ZH(LFQQAoe&q%tkmkC8{5JAlpdz-ygxm1dN6AT#iHn8&^zIJ z5M-{v54-G}A*B+6Y1BSUs4>Md7pK5KOpz z=K3heT*g1$`>2us2UWfommXhYFaKiElSuxnpokoWg!$iquOM?7|DDhSGU)$zD%b6o zcid+$|6)=6&uu5e+ap2dGX62$$;kh5#ecu_L7&^pzgScNf{Ex~khzS1jENfge@Nwf z!lc>1thUfUv)=xS#USx&gZbzFnILmF{|~ENpFCJR$6o%$q8a~Qw7-JPz5Mey#R`@E zdw+lYjh7;(f3tBRu_*q3)g_ufKJg(QDW`#dLFQQg!^ed%FTyx3^oZ2&4K$)idSYZi5G6*)bajT4GR(L?dbkRI4S2r^gb zp&^YEPBK0(Tcyf>*KfDAu~Pol<5IDx00a|mAJ`uVGRKy``M40;XJfzM_bT6q501XT zUjD^mI;N&0Knu=S5dH<3%lL=*g@2xR_n6}Uy*FYjt?*yJ_~@9)d;zg2{x5la$p5{A zewiS1EdR#%i05to1YhfODSvq0K&0nw1{QIZV=fcVD=pMTlW&~2xmxKcyP(Z?R&-?D zkBUVFAeeAH&cRoZIaWvY@}vKy^8M7^doSE!p`T-&f3f(Ax9xBrJWBPKk9>UsXqf*z zdrSQI_v{vo6X_78&06?$k${mf!xKl4dd{-;lL-fN}&t+&r&@oeQU$Q)b#=J8RT z`3Gwi|NSzK?X#DEvDhC=yp8=#X`cm|%lN0G&q_a&({+mfgU4srK4Kw0vaWxzDEc3@ zE9C#uFwP>#T*iN=@c9Q%DgLWYweGOeR{q7J0uW4C{~V79GMDjhn18_iOTN8q zuoeF6H_l?VK2|J>{#(2o(m(Sr$Q;YRv47yU^|4TmS6^Sv^XOPd&nO+;+GelKIueVb zqoqf}btK55I?`7I{{N2G)m>+;zZXEp>o{GnbQIHU$wQA>Xb#iHow{m;U6 zB*=u?BBPudW*gMi$&pIQqjL4a~c150icopmsGajdhtvsg1WBCtXSBZ6W#&wn3RCa4K?$jCw|K3Uc-?v@A=SODm*Aa^qgQnk^uz=|G(VW(3 znc(~}ds^UV*bA%b1eT(sE_*l|7HF;cL!fp zdg#|F$!n!P)=v*+^Nq!#=%FYxqzCrTg3J|q$fNqdCp!Gyu0K3KB>dd^y$80$INx}O zD*xe2hcvQM{?`4mSX2OliL}px%(3Nf?vD-cyW#l}J5|2Dy}Pxr!hikhpV@pru_*O# z)6YZoZ@52%%(46%{juBT`{{qrO6J#ax=ZQk+@E(mCvrM6o2MlfMMr&eLpr)1eq4~b zMn`U&rxlzx%JKPbrK4>tv)WkEk@faKECw3_wZZKH`y)Z-SRI+S2gs$2Q*gRR<$7Yp z&~+&m`pee&7mIB$lNb&q_?$rcM}o{{{D1hfB;lXq;=PLh{Rd~QZ(@P}`nAVq;}v2t zY3C<-O)y?@@(`yr+Dd5uRrHSpnPd4kw#N;1yn==edN*16N1X0cdN}l9>kanmK`e?M zKBx)lVI4Ff$fA0P;QCzZd$}(~^uTWMHKm7TL&ii<4`%&ku_$`@&6^=TuzwI_uFyk6 z>Mu7l_Lujo^1pM({1>hG1MBUxSTrmD%}}Nwb8PvW$48^L&Xx9=(*uhC-#xr#YEujC zvvvN(;vqjBJqJj-D+z{r6#uj6pW*F~AagALPKZy-@Sf6aiAOj+sPwRO;p{K$ z)q_|RJzSuD8tkteM?50PqI!s6e9C$lX4JzWrH6ZFt+ZJWVo~%kD<)hIf-I_s2L^l-@| z2fm7&9?YH-h(*!E?-RoHAjn*y2RFXQvqYXZv45#iI+~tvx^r_2{Q&E6s8|#o9rA~C z#QiWq<_aA()NxY&Th%4TcIIuRhsRg!>|(DT#G>foSaL`Y+%FVlQ9VSkojF4fhm{^~ z*nUe_d-Wg|MGr?(!u24?qI!s+9>V_qJhvO~C_VH!zPVfE^k5cuh(*yu)21OkaC;%h zT%iXy#vQ@=2|Ta-U8SS;uWc%`qNDna|C-I?7mF!)vxFBY#wjGnq$Lc72 z9)B_QFwWzDPvv%YTG`uHc()$!iN&VVAA7Jlo{RUH&1sGHP!j$Y4(hKUb1d&p77ph{~N%+ zAafc2#i93GaX;ah%6`k{cYGB&{>}PjVzDm&o6$Gui+DhgIhOzMeiT1#|W0c+4=>sDCPh3!BF|<#fOl& zqWl}`b2;*%zbyWM zQG<=Ub5Q=`S2+IoOzENDLw9BFwGek$kGsX90uW3%?z;=`QV?X0)q{E5jeJVn$LZ%P z-}ippE@q#t{EJ1Yj~89oF*q*9{a``nGX9IGNciXR$uAWDl`{(mMvi~8@nEqi{7>!> z;J-QgoZX>+LFQQg!^eX$zhB0K`(j$smx}i<`oF&|#QVYtE4+887p?R5M{nPry}95> z{{ee)(%5SyW0mKSCgjED7<|ic6W>&9#A>~1GD4-$dR>rsS9*F@)Eb(=GUoYDK=~e85XSk3WWdUac{~ z;n4x?^!OW-*NYqTj&JlGaIap?qwi=1);xX>U!v(d2I)IAJ|kA&QK0XLr50X*Vla!b zLpS*{HvB$n5~C&PXCBwj#5SMF@LR_!`03d2H=<-;5pN_h{JhT`b}H=7+?x%UahuvC~lh0J7Tp~^ivu|S=0s8_Move6hvnt?T2(2U5$d6L4|Y^ zsLs`kr4Yq33EPDv`B;P->G^mL8~#LU7UT6dp|)O~aS%ZK1vBbPnEBQM-zJno)}I@Q zG6%dApS2Iq4F>Jzv_@MRM>HAyiGm$lKb_DoE~G?l68j5YCx+sslSue8;gR{Tp6NGO z^#2Jxm_0WTi=v0W)X{?=bA=un(sP4cE_Ycc_?2GzL~|$oGlJ!B)_)O;QvQ|u!u^3D zb4B?#)cyLjm z?7HEfH!hm7P52jN?&KdGG!~r~;>-4QsKVxyV85QnYo|)NtZwv5VMdL<&L~m)Pyamu zv+>$?%3_C~HP0=~0L+=3)@U2htEg@qLgv_V;kfl&RC2IPZXB=8mG#T)U#BS@HG2Aj zm?8^0vR=Q%q5=?1SVy~|BSGd^9dY}1{d`KFF_GinY^(1ak1>LG&9 z!^d@oFBUy;%U`1O(B{vVMNkiB<3M6j^sv8Bb|6i(nYg0;W=3gxKBI?x)DDF{6gnvQi zHvU7;jX5qYRk_~&;fajM>EA3a6^mnIC=<`9Xr)4uh{r(}W29b?IhOxAacO>7T*{9e z`SWnvq`TJI8kdU24=O6IUW>SN-yBYBwBg(rfZq{hj^*76ajBPvQ?A4zoR$aVK&vlK zS!Ays#G>e7*W8dE9)l(XSyT@Zj7xJ-{2tK*$0rp^58vlp7C}9j#ie3V^icWhkRI4S z2r^gbp&`Yk!RM147u~GN|D`Q8ORV?<>v5@A#2byTngAtA94hUDAaiW_pCv9W35!c- zDE>dK?0>(#{EI~eAeadMg3N9FhvHJ!f2GRzUH@Bk%3l7(;=K0sDC<8*Az}V`PMsig z8~ztQ*KfGKY4K7(q}C2 zZ++ZaEUs_yO6t?-9~7l=TBB`-{yU>zCdeGizZ3cgbk8TDaY~L0XDL1WcU%85d-Wg| zMGqq{4Cx^gvnd5xR1XpCA7C15QP{ZkY^8_Zy9Py24`%%Xu_$^-ZX41A`v*bh3OzKW z{((MIf!haeCw`^Mzx&nKEw|zithdi%Q2_`h(mn_>$Cm$D`Uj!s`ONMk z+OOxY{t4^OjN$NX4S~pB=Y^{15A2kU5rrWB-8X1-8LAu(S*Bpu`q0 z1Dk?yOn(;@eofJrckv=HUgE_|!wNBImWyBc*t!vGkY-SC{OW;)Wcqr1nu#NLzbVKy zTTW)(7GZ@HFF_08%mj`K?BPXh`X`S(Nyd4Bw<;aIb#B(XR&->&9TSUZ(~%%^td7j% zhJM~;89=dWV1ZacOHF+>{1`30F{`44~oiYIQeZj}4e^AzuE zx8K@)NnWJpRhzB<5sMqEv)V4sBU-hS(;96eI8Vg;GXO|tR%>m5oDH(@n>QVC zd1b!M{ENjP@oIzlXMZfn+{S;A&VQ`try=OROs8wmwZY4FX$(3vdHNeO>{)k~kkt37 zrHF^b|5bhv?*A4_!QgEb{E2OW|Mb86*{=7}g2N}DKMnbeK|d(`H62~*^o_dUT@rQs za9t={f7wSN`fa5PuIn*y$*Qbn3oqTDF@9@aeeO73*|-Mx?uIv0OxFqISYwLbJLGp! P;5`H`Uw5Ye{i^>1E!~VX literal 0 HcmV?d00001 diff --git a/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4758.evtx.golden.json b/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4758.evtx.golden.json new file mode 100644 index 00000000000..e199f55ad76 --- /dev/null +++ b/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4758.evtx.golden.json @@ -0,0 +1,61 @@ +[ + { + "@timestamp": "2019-10-22T11:35:13.5502867Z", + "event": { + "action": "deleted-group-account", + "code": 4758, + "kind": "event", + "module": "security", + "provider": "Microsoft-Windows-Security-Auditing" + }, + "group": { + "domain": "WLBEAT", + "name": "Test_group3v2" + }, + "log": { + "level": "information" + }, + "message": "A security-enabled universal group was deleted.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-101361758-2486510592-3018839910-500\n\tAccount Name:\t\tAdministrator\n\tAccount Domain:\t\tWLBEAT\n\tLogon ID:\t\t0x4A727\n\nGroup:\n\tSecurity ID:\t\tS-1-5-21-101361758-2486510592-3018839910-1113\n\tGroup Name:\t\tTest_group3v2\n\tGroup Domain:\t\tWLBEAT\n\nAdditional Information:\n\tPrivileges:\t\t-", + "process": { + "name": "null" + }, + "user": { + "domain": "WLBEAT", + "id": "S-1-5-21-101361758-2486510592-3018839910-500", + "name": "Administrator" + }, + "winlog": { + "api": "wineventlog", + "channel": "Security", + "computer_name": "WIN-41OB2LO92CR.wlbeat.local", + "event_data": { + "PrivilegeList": "-", + "SubjectDomainName": "WLBEAT", + "SubjectLogonId": "0x4a727", + "SubjectUserName": "Administrator", + "SubjectUserSid": "S-1-5-21-101361758-2486510592-3018839910-500", + "TargetDomainName": "WLBEAT", + "TargetSid": "S-1-5-21-101361758-2486510592-3018839910-1113", + "TargetUserName": "Test_group3v2" + }, + "event_id": 4758, + "keywords": [ + "Audit Success" + ], + "logon": { + "id": "0x4a727" + }, + "opcode": "Info", + "process": { + "pid": 772, + "thread": { + "id": 1664 + } + }, + "provider_guid": "{54849625-5478-4994-a5ba-3e3b0328c30d}", + "provider_name": "Microsoft-Windows-Security-Auditing", + "record_id": 4687, + "task": "Security Group Management" + } + } +] \ No newline at end of file diff --git a/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4764.evtx b/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4764.evtx new file mode 100644 index 0000000000000000000000000000000000000000..f261d5310b41c72bff6a2fd9d99b944997dec9e7 GIT binary patch literal 69632 zcmeHQ3w#vS^**!NEJ;W<;Ta!*p`r*vcnAn0Z%6<`K!Zqat3(nCl2`MPAe070!D{7U zR4j^!@)rda6%++QiaZ2CK_e^-})VbD13&ObB1U4F}*o!9y9 zcfWh?xp(fJ3@ezFF{L1%>V7Y)O5M?0Bz>hL8tYFfR$wgDq#}9l?msas%3<@l0OqBiDs^fvP zt^dz|7I{!7b zpZ6`nzDafP48ZSi)gZ}Pb!-%>d-1i8sqIlXHv{*4vCe(?96LVe%YcqDRs){-)3GDU zG@i$J0-t}6^!@R*c{N(Hrct7H+qk7(xsta(eEXK1jgt=c?f2@0v^B^HpEalnJ%UZn zAb(y=jHO|81Lac@mE-qZe0|regBz1$sgeq*00+x(AXe*1lW|%(mCz;B1^>!uBKG9t zoLp?DBb|ahrBsYx#WV?LrsH=p_IIIaI97zTJ9Wjs9@y$iz43p3(0p0gFOODRdlF?O z#YdcP`g0Lg0gHYkv-0QlfvK5l3Tm>o>qw9?mMo(O&pwh!`)s+e_I1TZn^1 zem`lx@k$RJT6igwD)cLHD4CLD2F1`QoOYu+=^0#oPrlF#FhA)i-kOh3a8QTiG2jcA-YZ3>tw!ZDA(F?qcx<2Lvq63^Qk zOIbLP%c?*>iTETBwZe~9N~gnScxkL&7E|?8JZw;-H2mNyz@I1E_-Hf=kc)*WVsjeb zDVEydht!{_{K zZ|M^Uh9@g-g#dp%#l>hTx}4Y<^XFzrbO_GOg^-GL++1iWq@pfx6;})mqV2fRIg{QAN8!DT7gAvyk>dIs{y#Ll6aY9WLNfPRDjJXk^86SqugS zanj4u<51jOY!yHrpqS_!oZ%CHJt@maS0c}BUFAEGn#FkiO{lGxn&MPQQ~yHAXwU+= zjH4D5M@?`PRRCN3jiUtpJbfqr%fPP`O2${CmtxvtkEhrDd_#QFs=hj>BL3OX|z&e8uc3gSL=QKd=d`g}=LlYG^&N<{We@*AzGiPk&*y<50UhLmD=7OzB zby*0w>vQ`Y%NNJa+s|Fr`0`gO_R_b9SN$Rj)rHSOsSU&?x3l~idJ{`Z-1Shs2y(HX zJz*wNZg*K(zc2Q}J8=Q=QN0qf2aMH{;o{gmSD@I(Lh>b`Ui9*7YTc&D z^#!i=>#n5~`OC+RrP#!qdXj*aue?}Y*&%dgO4yY{VV@fe<|=fxCvY`i#kn{;bai~# z)j7B>4>)6}*=cd+Ab;1<^}xv$T#(9@-oTYTm8CFt%&!cgj18ddqprO$gt7^AVYF(V zOJCr6Q+C6z&jL%o#f?C$L!#clBEjIY|_IIL=A**A-k1}b!) z=_%_t{xb7h*bN^Q@LMVRO~U;a7YKg_qY&6{4M&*M7{fEA9CxRe9s&7O~gy#o9zop*J&{)?7pFTU-fJ(*)S=hf$q zW0fbp5{mAk#~^%nW;@VAvz8LI$~*EFHA7}NhhAz#IiB`aM76!B3VS&I9S$n*P`RAF z@Sx7dPvt)uxBhYd{|x@U)IYVqfq${MZhdy!g?U74k8xU~3IBrZ2Q^n8w*J5PpZH+M zerLl0vtU=E6x!e$2;HRxOhF^G@@X1B6F!E*GvJ zDX1s&6)QcbcK_N+`P9$Pt}yYlVo~bHs-)4npY003)xavq99up{KU)G}vY$P*T}VI0 zr-j;J?pt#F&V4H$zu^w#aQNRqtn@>EcMz^CLD7cyY)e-$RF+>1eq)JkoOb( zLtylaJO12n`{DR2{9KO9f7~Z@=5m+#X^|@bXEq=I)=K+eJ$@34XX_nTL~{xWw-1SE z9|W0W%ilbH(gp_Or%JTbcd1+-PudZ4Z^Yu)WRv(wELMGWU%v_{V&2!!kN*N_QV=_> zg+CT#j^*DNKSA(B%(t|I)r$A$MtX-nXMuO?agkVTxtE$gmq)bt0H-xtc>>WZ;9Zb8 zmUkz_MKmLI{jZGe;N40OQ@7uf5jj1WwS!_&^f2I^a6JezSLmT3wS)QyiTHziRQcbz zZgB+5->jb`7Nz`ee=k)2D-($XnJdb_q4tyX2j1cjs?bi{tMu?){DBcx{DJkjNGzJ^ zp$ct;Aakr9%;O^TdYN~LOBXBtC-mDe+Ft&}q5=?1xP9jOD9BvKKi&0^k^lQtz897r zU1Tr+V$qXG{>!0=2?`1GzZPFX<}&^}2F9~R|9@1uK5t2f-S+Y?7RCSEd@Q^@5@asp zAJd(T`d^~>?~^g$b9?z0iwZz65&a7?m+_D1l1BdTSNR?{aprHd9L6)IH1IFT9LslV2oCfMfDKD z=Vf7f;O8a}DLt&5->FsP^k6nlC>BKzMZ-gSVE-VVp05G^4O67dk6h8LFQQgjqwrB+x!{6*5^|G z@VtRY&)WAs7frr#-sTFWqnt@?zO$ku>wZ)$DgeQR>+uA91({=YR4+gJ ze=6Tk+_~%AZ5H}D*7+BUFMHb#^}(a8|MJ1FKLr}*KM!9)<}&^bew6zak1GC~zT0c- z(ph%)GsR-nGkfMPorM`-8#%4f=3&Y{kFN_d$MSFVqYd?WBd=>YY3ygNRC+ja$?Bc< z>Om}u9=2}|>7f%eA;_Y7h+sc6Ob^`OcueVG{|(x!k<)`&KT|A<9&%p_>4E)&AajKt z8d5*A$k@+(T$TUHPdn|hQvTN4XR&y?@)u-|Er0X)sLuR@Rf_*UnMZcp%fDFcizVL1 zex|g~g3M+7)1jxOpULTJ#s9veGix8T5Fc6BzgQIgkJu6Ne`y$J5o9jozhn6PgC`XK zRVP}vUuG-+Vo?DICaiysM+BM6_&3Zy;C}LxD&NK5UOdnW|MeSZFaU@#v)11W zAmeqMu2DLQX}0M8M=Z1l_47w&3yy9+q`4@`{z$yF- zGMDj>aXuse&#LTqegCX4?d4xA3jdNyTrJ34#y@Jik^i+S+oMLG)AUhW{f}4_-X)cO zy&!Wp|Lat?m#kd!slEJ*Md4ji=6@#qzaVor|Ievx?;H4(=P_ILAGC;9nen*R1cgNW zk05gy|9B2>^gqw5Tz4I`E6ZN~#i9ZboWCOa7i2EuAMbrM^1ohX|L*PUH`&X-SQP#x z75xh`m+_Am#Tog3L1p``=O3cSZS_B5QFxbB_!nd@;~(!cH1hwV%632hoT;mA_iGvX->7o^ z_`TT=J!>ofVo?DICd~hw7DR%~W&GofXh!~DQu$umeeGU*`4@{p;?;)mFUVZRzt(iV zk^fC9*OmXc>l=Id7mKIkUy!+se`MFl|7Ml_^N01Dyw+C#BNom0-`SE#khzTiBeyOT z{&}6>%PRYu{}R6-a{QaEs}zfM`A@{!9bUg9$Q;Xm__|80qcg6n+@i8wn|Zs|IQaKY z>i@p&`aM4~d%uoYtQb&od%`@T*GF<%qh*2fNAMM7j^*9>JiDRJcMV%d$Mx|~N)L~g z?ToRa2kXy)#NsdyWnxKl@X03YVLZNq%&~efe-30=N5%7ww<`YU9{S7@|JLiHSd{vB z;h0c;9FO_`g3Ph}JE1=6@Bf$i=iD89Md_hW$0V-QemV&i<{ZL0i-Ru5`qrTne?W3i|J1QThW1({>Z-`pP? z-gm?EBetu2dwX_iVTJ$t)jzZOeqvGT--cg>>fca*2$^H~H~M3@&G*y)o|Vk6;dF=6 z(V4&Ma7N^GWHwJrEQ*eL=Z19jOZag?<{BNjZJt(e-YCcCJC%;MEX!_VMMu`#1F;xv z2-F6*2kegonPYWi-X0*AGETwit18#yD+aGlvCv<(&c9e}gPFu|D8c6h(mxVpF6003 zFOr0Rj*E9G{`c&gv8IUy{_EEsn~hh9#iZ>Y=QY82#j*XI)@aM1{a4UG5@e3$-`E~E z)bR=$GT_~0=^t^rTj^o{;nr*I)q_|RJ$z6T(!*+KLXbuE5W)4i)cX=&is*se;%iC| ziwBL0pdQTn%VJUV@cTDIdSL$`$Xua^hSXnfX6!HTQRRR8wz8g-$`^^4WkhzS1Eqor! z>nhi?UY|O%nXUYbMFk+3F#oK7LFO|4(x=-n$`nH*0*sBMzD0(grh(*!E$8jM& ztU;SC$fA0PpdPMSncxfRfu9q+rSx#&gL{uhP7h|!3B;o4;o*dEJqR*a=)sNe@hq0- zP3&K4l#WUgPIhW;p&wv94i$@{qy7Gnj<_Et$XubLhB{8lf2+FK*v`DI^zi7??Vat_ zgIE+j97zu8f%}DmEUJeHwlk;b;egV^HCt~?w^t8hQS@*yC0q}JEUJeH>LKj!&vU!+ zj?zP~qZ_+KP7h{rhgcLnG;JEv1Gg7~%oTcYW84v(pTP6V-&Hy~@3jqOR&-Rq@n5rf z{9-W$Z(@b6~x^N2&L{145(@raf3ub&@I#oq(*(1_HLsW2J%3>1rI<Z z-~2h~G@5RF4)kY5$A<+sS>oTiKNgF^f7jU|f4m+(S&%uFe<%23yxk!ToZ z8UKjE#UFBdSmipi{b%d!HV}Q` z@6kgLWRB(C32{In-XUFT?3evT>EW60wq!?64`%%`u_$`z@p`x(1eq)J&>;I|tb>nK z`EUN$pCVZPX6qNkqLlxW`$FZP7av0Ait=x$&*jL6{<8Q3j*C84df0Qt$uU;^f%SfY zSX2Ol3AYc&V?xLrs|WLb!Eh=z#-*RAe5V!UUtur*V(~tr`yhnidq0JLLFO|4%c-;Q z&-LK1ivLM-He9~b*7!&)ia&h&!*G8n$Q;YR6XGL%owWEvPLC=*TypZ09DDU37DW$N ze-y3Y-*MlH)g&th}T$=Ut zH>IQY!*hxwrz5ktTP%u>1|JRAksx!0jv8#-Jptt}eud+Y&y*he+vo^|)Is zDgeQR-N>iJeVl%-@_pAw?P7M@%D-5Y`gs1i9fIRx+z%FHF5|zD z3Wa|jpZr4cUpc*?f8_W#8xIzX!vEy<0sfn#&)F6F7i5m*KYTnG^ZR8yxHqOHeW`f= zqVM}#LcHHLZmIWH^`dp&{_yQvayCvn*tg%S6VljgC1aK6peE$S<|us2a1-D4*of77 z(qx28<@l>jm*9>5U2te3_T*C`=@jfKC4B-YO~RS!_+5nj+2UhYi1lh=zI^Nw%y9dNH+&7<#V1=c)% z4_~6`I|k@GG(IC%-!Vzw5lbz+0L5SyVux<>MQr$e)Fehr(9b-opNVZgli|0HRq!*g z;crCAzCzweV)%hG9+NZn@_{&t^PS+0c#4bBQuLd)_A$T|(!5%2?O@zAgLlMgt>`Km zLD|$9)OMrMG#Er@A?<^72wj1Kn1;VEcpa$D)r+M7#WE4w1tj^Hj~nUvcm^B(L~0h} z^*5omUY&6eK>P(W>PwjU)&k!qltR{@8;COdy%3+h8_x{}?BujYtBxa@4E{vHj;)_g z=oc4IqBfEJ1+NoB@zOCQ{2BM)+*eNZ8!Y<&g&xeF8;C{G!(Z#@L6EsZ4-M(LK`xiO ztP?!0mp;+#iT{jX`J44$#G;gc`{YQzTf4n`ku79z(KK=Jkw0iYK=2JVa`RBFsr)?4b1(`efM+c2X=Y{xkJngHn zIVISy=keO>rCe4tdbuF8Mqg)?sQs`1o`BhSZ98SL{V$s57GwhEbWUruwdhr>ZyZAA z*mB{x^-NT9uuN_oug#V9%j{pLDjhX?@|>7L3p%o1zr~^g5KLG{JE0>%=2#tZ`*!fu zdYl`q$2?w9pz{4}O0Q9onG{eH2y{K;8AFNFW>_yVUjS|xbz+9-s~vAi4oXG4wi^~P16Q*c_O z^w4TDyJ#foktn|?4FBeBp4`$;)Vo~(4 zr;dLRWUkOdLmCI-;az9e_%Z>5{n8zFyZ!r{ed8JZ26xiF3Jza zMa=(iRKB$-#WwRV7JCr&Xa*Du6cXWIkhzWj&~sysOG{O*w;uj9GjjSji%Z4g=orev zGb&o9kR;-9&;=N&7i5m*zfN459~PJLBS-!`kT&s-Rkp^ZV)28DiYrzjF5Nwg(;96k z_XXg01es%bcS2n1rJc}Tok`Y z^uX~+h0??K6E2RR9?arWu_$_|{9Q;7>>mV~EA-Hi;?m&rNsfzdQ04!^rkX`o{DJkj zR4n3+#+Q$S5+x3m_Cb(2w){^MmllV`rPCDupH%j}$6o%$q5=?1gnvQiHvU6#DeJ#d z<@=6*SDmnzf3Y~{JbH-rKS3d3{&`NFAafi4WnucCu5$fm>08;WEySnR{f}6b_UD47 z;q8wga~c2lEc+$vUgoFVsQ7<;-|Fh8EbwoA+*&NIY4LLEljt85rg2)MZG`?ipkhww+4XJ;i&s5;{f!m4Ss`Br8#nnr!_yggy2KNe&z;~z^XBtGKw zcZ&Z*dlI%iZ7cs`an+s;mwZ0%>5i(-Vl%ATKwuQ?p9%kh%)R{cysp`b|JpenHd*1ne*J?#<9(!F>Yv)*@IF$pDE?>L zjUoTT`WIx5<=@yp;CX><@C_{O!aFFj#mm5^ARN=*MTK8e^yOW=2#l9_@zSsY44UQQ zS3b6`#Tuk()DyqDVIi5m9-pS;2;OfBa?O^LS+_-4A;nA3LO8R4qXK()5u5(WBTtfX zUf@kiM{k{({jL=qS#QV0;^}lG$Q-L9^Ee`&hKV2L=dU*_{_pR9`A3oC-|YFTSghNQ ztwaowhH-vD=2-s2pTFXXo2(n<{`4Hh`>L%sHD8n$sd?3A>wm=Jy7k#@7v>Qy-_B`` zHXfWO;{BO|%(1*1{bxg+7sx9_!=At1qV({Bl^(9cYWm3O!EAg*EQ%g7cZBr7{y~trLJtjgd}XdG|MT1Aon@u`t;a=T zQ2_`h+&;X6_*#%Tw*1ZGBGf;Li#VO9@_p>Ge4F_fi$UVm2J_GUSdh7m|3aPrSj|s^ z(0wVPE77&V%XVoLIy8Cu8#C-#cb1UU`-y7AL*oA`KM41Kw@Ja^Z58~9ZGr#vzx&y) zXZ555$DTb2`HVt8DEu`Yo$K_CI^$gub^CCgDMx?VM*;e6rSq=t)_>9R?8UcTv?p`y p=Dhmcajdd&CGOn?Z>A{G3FKH~irzcqcTwOy1TJ59rvLq_{{U9!ggpQN literal 0 HcmV?d00001 diff --git a/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4764.evtx.golden.json b/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4764.evtx.golden.json new file mode 100644 index 00000000000..a36c3a620ad --- /dev/null +++ b/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4764.evtx.golden.json @@ -0,0 +1,62 @@ +[ + { + "@timestamp": "2019-10-22T11:33:57.271141Z", + "event": { + "action": "type-changed-group-account", + "code": 4764, + "kind": "event", + "module": "security", + "provider": "Microsoft-Windows-Security-Auditing" + }, + "group": { + "domain": "WLBEAT", + "name": "test_group2v2" + }, + "log": { + "level": "information" + }, + "message": "A group’s type was changed.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-101361758-2486510592-3018839910-500\n\tAccount Name:\t\tAdministrator\n\tAccount Domain:\t\tWLBEAT\n\tLogon ID:\t\t0x4A727\n\nChange Type:\t\t\tSecurity Enabled Universal Group Changed to Security Enabled Global Group.\n\nGroup:\n\tSecurity ID:\t\tS-1-5-21-101361758-2486510592-3018839910-1112\n\tGroup Name:\t\ttest_group2v2\n\tGroup Domain:\t\tWLBEAT\n\nAdditional Information:\n\tPrivileges:\t\t-", + "process": { + "name": "null" + }, + "user": { + "domain": "WLBEAT", + "id": "S-1-5-21-101361758-2486510592-3018839910-500", + "name": "Administrator" + }, + "winlog": { + "api": "wineventlog", + "channel": "Security", + "computer_name": "WIN-41OB2LO92CR.wlbeat.local", + "event_data": { + "GroupTypeChange": "Security Enabled Universal Group Changed to Security Enabled Global Group.", + "PrivilegeList": "-", + "SubjectDomainName": "WLBEAT", + "SubjectLogonId": "0x4a727", + "SubjectUserName": "Administrator", + "SubjectUserSid": "S-1-5-21-101361758-2486510592-3018839910-500", + "TargetDomainName": "WLBEAT", + "TargetSid": "S-1-5-21-101361758-2486510592-3018839910-1112", + "TargetUserName": "test_group2v2" + }, + "event_id": 4764, + "keywords": [ + "Audit Success" + ], + "logon": { + "id": "0x4a727" + }, + "opcode": "Info", + "process": { + "pid": 772, + "thread": { + "id": 1664 + } + }, + "provider_guid": "{54849625-5478-4994-a5ba-3e3b0328c30d}", + "provider_name": "Microsoft-Windows-Security-Auditing", + "record_id": 4669, + "task": "Security Group Management" + } + } +] \ No newline at end of file diff --git a/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4798.evtx b/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4798.evtx new file mode 100644 index 0000000000000000000000000000000000000000..58e6e280a71b6f8a8dd41b5f8f0046aa89baa8eb GIT binary patch literal 69632 zcmeI43v?9a702)FE1M;35@~8gf<#b=3Iru0iYVkEYIw*icn&IP5)uf(l0*WQii&Ly z^(YiYv}#*U#i|^w#RpKNTD3l^NUhY0+DfYhtq%yGmICSj&U|;XiJ4+6&N;KaU(RM; z-^~5b@4MfNt4KnW-TC7=WjOQ5u_y11r(7T)7K&271e596W0s4hew-CpsG)BAt_&32aT z+qxt93V9KtmNcS0VWOR(^%=G`I+0XlagniW= z^qhn3&&@-U?j3B*HrL{F?=$P8(YFlO+|c1V+~-KN6Xk);VJ`MN@J((forEz>=Vv@l zyQUyJ`kRGYtxU_J3~T88tViX_yuNDtkEd?#dB?Ti8d==50(Zi_Mr6|xtnv+V+mI2a zQo4$&sGb_J{XM)QGtI$`nPFGf9;8Uf>O#k3hj@B!dKyhO-D*Lq9>)UlE))u3jC*23T)c8~n99+S$Ewcm zMBFJrJ+RTk_-X0YA)089#Vor^fDKyI3mZHIxINf2LSr$2JS>ce%~^bx1CEv8&RxTl69V>e*jQ$+c-Bo_V6@g|T8yq$5WquJi9R+So<;0a!>*3C z8$me&Rc8zG#%r4e`PTsNLZnGp^OJnTi!W)qusuEh7`a#B}zm)6$VupvQY z-J|Kafo5BHlWoWu-chUrqe-kK_IkSU*(=bo0Y64Xl%f$1tvs|h42^TTUTXjx>1tk%|%=)h5p2kxx;s10g1T!FlC`#FsMVUAnwO>(++5K>e-O8}V$8m#nZ7`qr zoxX`Lh}LV-UAywb936WMYkm5ug+#rF^Kz?|fq{JqMjk zPH%Vi1e{k%fvy4S#{Ew-{oCoB0H&AIOxvH@l**Yw=gcB=rX5_IJIuuRbarN&N;nu> z9cs=!xlLtuhjTl>%dm6)mrz{}N;B}PhqLqjMx2n@sp?|Ttiuma4JUQAg#kV{jj~)- zyPw;3*HNer5h@1C#T4m@R}bn&n0?3z7N(wsiN(__hlXR_iF2G_c|LGZ;PpX=i3rFX z+`>8db?MJz5$aQPOZDrYto;bS2WPgA@tpk6aitHAk41dB5J`AE)+T|+4qSoTF0(8~ z*)g@l%$$nRYby#)LzJ3|cqJn+31ct-_rXz^uooo>*H5+wx6SSLbG;WPQ5AY}P2?02 z17UL%qF;u!e`(G2nQ(HxEe=XCEKO_1KCaKc53vZab{p{C$_xJ3@>)`T_FEHkI@V{O z;%uJ!sLwvYD%WS6aP3;m`?~9LNZ`7QBMi@HuCRCr?K&z^HA#(hG>&kxWUzKE)UMiL zL|pA8sv6$GRZSpnDj43uX)X{q^$PFcdL>br@D8p_67>g*;WTEOBGcXLAqE*>(?(qjAZ-l41FxoM980v>$eGCjFB6lCRA9(pJk^F@Bi* z2lQrQa{hB%jonT1A5UOzC2&N}f8|&nP5Jh|D%&~j)pN!FF6sSXUh6f4T<^4v&@dQo z3{Xx>o~K_X8y;@PEV=dN?6hb1j9J@q*&Ba(;*{niaZUGG$hZ=X=O52Qo{tzzyX}7? zr}>NXkcXvX<#D9Qi$x=V$E({CZ0tl%&jNW-)-FOG2}<6Q=b2%e#6Mobz3g`AyuU5> zmb+Lq0ul@1F3M7qyD1pyuD{+k>gJ5(=K`E}zD|D^i`95L!Vya%%`iwhfR`vsP41Y` zcH1=arZL`f7mHc%R@}b;Gq2yrJ8mt37U3?+QjCSOn{~?Z3rS?qabs ze`oHZ%;(%){5``A#@67FX+nbN>^p?9=EIiow_&EshHTx<`WdUj*)=EH$}j z8t&t_&b#hjPyJmi=HvNoa$XhgqRi*q`PNKJ&Z`Kdc3U)f!3J-+i^al2FTPz4bt`xE zUB4e%o`k}UN_rys2>iVS{w~T=le_cOmgt(&yVrWlT`W%f^dBz_;W)GVxRv+A1BAOMOHJexT`YFS{S-Wm6lFf=j%+0@`Tc5lv-9PfUre9kDR;3b+`r#4 zuR-EWCEl!xGM{sIsb~1BBHV`DU2$#Qd0xhMvG_0RA-iUj=aD_|f%c7v@1o4-++E^3 zf5(~I!>{kS(Od3faoj=cvRTObxh-jX)PRlO zlKp)!KJ*Y}KIiUINAef{xy6F7Hh9ZjEaswOWO3722HHeqqDs6(na{bq#2NnDI=78y z#J=M#cd@wZ!($JA!u5O0jBQO&BHTq;YI5(z(9zb6cyCm_r*TFs^5@sUo`^HTy%+Y` zEoHtTnOsNao11%o#h+>)@RYk)EZo2AqRDn%{j6Xo)HEW-e2AAQOHF@2-f-ViS~=HS z?qbo6yC_Rd?!687Wt)DmZH=e?E*3B8J$&;4eC{#LC}DrU6JHh+Wj^N~G`EFCa-8X7 zc0cw^U+Y0nxr@cBJJU0sdhz)SzPqXGsnvPuZ!z~PQ3Z%HpL56ENK58^g4y}*jpszX zjrhEi7!d;Z5CijyK_uGp%Z~mdD{w@}Ud+wg+65Kap97LJVxx2)f zQw;Z)Cuc;Kd&*rbcE7d+-Ecd-~nR!!#Kj6WDI$8!QvmYUoLI@syp<-Z^7EqAf_&WSmz zF9P^=ANM^LU!5W0F3M7qd!gZ;w`KJo)_dyjV)2*`f6vF<$HCu4na{a%iELVO{XWR- zyJ~ggoBW@NoPQC-{~P4%{(Eh)_zNq)Bm#Ax?|o(O`%uGwCtnEeqRi*qUE=$xhI`ST z^mo1GE*9Omi?Y<>ZgA^D2`B+2pahhF5>Nt4KnW-TC7=Y9fD%vwNNt4KnW-TC7=Y9fD%vwNNt4KnW-TC7=Y9fD%vwNNt4KnW-TC7=Y9fD%vwNNt4KnW-TC7=Y9fD%vwNNt4KnW;;|04qb1`AwzJOBUy literal 0 HcmV?d00001 diff --git a/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4798.evtx.golden.json b/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4798.evtx.golden.json new file mode 100644 index 00000000000..bb021b9d8a3 --- /dev/null +++ b/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4798.evtx.golden.json @@ -0,0 +1,58 @@ +[ + { + "@timestamp": "2019-10-08T10:20:34.0535453Z", + "event": { + "action": "group-membership-enumerated", + "code": 4798, + "kind": "event", + "module": "security", + "provider": "Microsoft-Windows-Security-Auditing" + }, + "log": { + "level": "information" + }, + "message": "A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tWIN-41OB2LO92CR$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-101361758-2486510592-3018839910-1005\n\tAccount Name:\t\telastictest1\n\tAccount Domain:\t\tWIN-41OB2LO92CR\n\nProcess Information:\n\tProcess ID:\t\t0x3f0\n\tProcess Name:\t\tC:\\Windows\\System32\\LogonUI.exe", + "process": { + "name": "null" + }, + "user": { + "domain": "WIN-41OB2LO92CR", + "name": "elastictest1" + }, + "winlog": { + "activity_id": "{c3ff3c1c-7dc1-0000-233e-ffc3c17dd501}", + "api": "wineventlog", + "channel": "Security", + "computer_name": "WIN-41OB2LO92CR", + "event_data": { + "CallerProcessId": "0x3f0", + "CallerProcessName": "C:\\Windows\\System32\\LogonUI.exe", + "SubjectDomainName": "WORKGROUP", + "SubjectLogonId": "0x3e7", + "SubjectUserName": "WIN-41OB2LO92CR$", + "SubjectUserSid": "S-1-5-18", + "TargetDomainName": "WIN-41OB2LO92CR", + "TargetSid": "S-1-5-21-101361758-2486510592-3018839910-1005", + "TargetUserName": "elastictest1" + }, + "event_id": 4798, + "keywords": [ + "Audit Success" + ], + "logon": { + "id": "0x3e7" + }, + "opcode": "Info", + "process": { + "pid": 780, + "thread": { + "id": 1740 + } + }, + "provider_guid": "{54849625-5478-4994-a5ba-3e3b0328c30d}", + "provider_name": "Microsoft-Windows-Security-Auditing", + "record_id": 2996, + "task": "User Account Management" + } + } +] \ No newline at end of file diff --git a/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4799.evtx b/x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4799.evtx new file mode 100644 index 0000000000000000000000000000000000000000..a1bfce52dcc60fbbde46e3b0b08b70e83cce1e3d GIT binary patch literal 69632 zcmeI44RjRM702)FS2iDPHexCw(L_{01p)>TMKt6?#PA&no`VXSgakscB!PgXM#a`c zJpu(0t=g7T@u(cFS``pctJaTJq*iK0ZKc(M)>;VoQ3|C0JNxct6EnqDoO5P-U(RNB zXWq>Hzu&v>-n+A#l+;z1*49-~=jJmzTClaqPZYH}clp|{qdnTTeeH|r1(bjiPy$Lo z2`B+2pahhF5>Nt4KnW;;BN8a7t1hakpN;qUvF5aG;lsEoke^QUNK5t5SnvP+H`|#% zv7kKh3OOO7))b_wfkLG6y$j2C13mP#q37;6TtCLN(~tNLSN2G!Q=xbQShgq0bCFAAoHw z_ROQXcr}-*(Q^P^&&B?Mv;fEIu^mkL_$k1%d^#JytK#MxI=u2(ZEZU+S2AyN%R@Ao z7UIf{wnaF2VO!g!&?Pgv_nI(Gu&vLBtxEKohokKLrQ(bi-x{EC5IYA4i6RlQLQ{=D z^ve#=h16u9i9?x`=`ZxtSae%tdVD$~B>~n&RE%SN@CdQX@n!n$NTZ3k#0(&-#qeuw z35+fhppY-(r%=F3r<1WmJiSM13QaNHYC))En8?-1FFL()Xd+@{%jmHG?v@jwzXYrMSbP8U`%9-_A zm@dZQg_yUw;8+Rn+%-tq0brki7c0ya&%GrbMr&=RMd(@u0X#*O=wsvIRm46u;+nJ$ zGbkqkPl&SoRvNseJ(iUEyCu+`gbT7{RuUuci=I z(66-AtnjqGX;g?SHbOXiOCv@ayKW?fGD92`c-n`&kVR}db|oH@!%5xPUE12_z=i~o z4UeT_0L`}WCfiVKdPlPk%qFpxv^P_Y&t8R&4fruC!W0g1XyvKBad;SnYYbZf5J{!5 z--_Dq#KD-`4RFyS^qc`ls<(CXq(#XJSZ!^i(1D{GPu#inVH?yOxB`odtrcI;%A^WN z7)SlFLb}PjzK8^uWtv?U@ zd_$k+3!>$=?0K>xougx~5pB;syO^l=NZxL@GBB|Pcx*y;wA)zd?ijZEg93-EO8C+O zNbmopG4_WiG~qapn0wBoQ&%r3Z!TYT(LI|+p6l=XT({0tVnKRH&ho_)*7^DJkpm_L zFDQC#`8(O6ax4<=g}EAyr<`566<^PeBtg2^cIp|}&+)GWTh6xZPfOc z4manX(XKM9)45%bG8jAmE2u65rI~ot!`XSfp;*Z5Qgsn%*5QYjMl5x;hXFn}g`$qC zozHC_br`Axgo*)a!Xl(QES2tr)rXv5Vd+^|SiH=#X(XN(LNBNAdOSGI&a<6~gKh)j z0H?+}4nRY6pNKM_Zzl7xs;Nlaea0Z24luS13p+Y=J%~{B-CfWGBKxf zefAm7=B1DN>?1to`iv8! z0o)j%Vl8p~9*q^V^ww9i>{Zx$#an;+##bTZiZ@<=ybgIiVlwS^;H~WDFRw$Mmd=&O z(IPJvjR2mn?o07vH*$Iu^S>vm${3@uDI7A(TXyUbB{0Ej&TNertG$5;h^`{x$5s?F%P#!cri+xc>^Bu9VAsz zmYm%2&fIRdz5Up3ce#tj{6mdToR0us^Jzu#ENEfwE#NN7l9PL;;XY~mg6r>f)!)Tp z9`4^J=2hV?$~?}Uhh|!0UPU0aTT8*BP403Ri}{CNdAAJe*6iuC@c^_u1Am_ie-~vQ z=k5^Svkdo*54`)dyWGX16L(RToZR_N0Jp>A3)er?)6M$?V)3%xhZ_zj+>!hR{Jj|d zF3OUVd+e?)(X}OaKk6=bu{iy+zr8$+HjQzv@#rw2z(ah1DRbmA_`l9T)KhWqpD@4c_W zRqkT3EAD6FW~3dbwPu~nM%A_6=fdh?oiM0 zS4FrDySw7Lx(nTm?_%*^)!d;XlC-)qiI?>vHPM$EwReu+Yd8i|~*h=*G0(|Hp$~?~9p^oG) z{&P$7zuw?3cd^(56(ftA&N9%-k%=nt5M>_c?ht4AYwO%LpPlwyce#tjJs+QN=pS6a zx6a(r1SP^pgPoL458p-6&yyzY|{;6J;Lf?l;52CNa*OVs=0Nd>`vUSGkMDsykCN zo_*z|G2h$LZE$r?>O0K+YE%KD%;VfK8fl5#Pc=K=zxn)-yWGWM2EOT@m{*0nDDyaX zE|E=38)NR7MP#p2bU-F{vZz)#&jbL!ur zM!1Wz(Tq2v6SicW4`{u7}e4GC>QS4s?@&5+- zrvF}BEdJceD-J>37yDn^{~^@y-^ufTP7!4u=k5^S2OI7~_NBh>E_bo$#9fpn7k7hO zH%dSWC;=s)1eAahPy$Lo2`B+2pahhF5>Nt4KnW-TC7=Y9fD%vwNNt4KnW-TC7=Y9fD%vwNNt4KnW-TC7=Y9fD%vwNNt4KnW-TC7=Y9fD%vwNNt4KnW-TC7=Y9fD%vwN